nftclaims-proj3[.]vercel[.]app

This domain, nftclaims-proj3.vercel.app, is identified as a crypto drainer phishing infrastructure designed to siphon cryptocurrency assets from victims. Analysis indicates the site employs a drainer kit, likely targeting users through deceptive claims of non-fungible token (NFT) airdrops or rewards. The domain mimics legitimate NFT project pages, leveraging social engineering to prompt wallet connections and execute unauthorized transactions. No direct brand impersonation is evident, but the thematic focus on NFT claims suggests an attempt to exploit trends in the digital asset space.

Infrastructure analysis reveals the following technical indicators: the domain is flagged by 16 out of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it as phishing. It is registered through Tucows Domains Inc. and resolves to the IP address 64.29.17.131, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain was created on February 21, 2026, and is currently present on six security blocklists. The SSL certificate is issued by Google Trust Services under the WR1 intermediate authority, a common feature in both legitimate and malicious deployments.

As of the latest assessment, the domain remains active, though it displays a "Deployment Unavailable" page title, which may indicate temporary takedown efforts or backend adjustments by the threat actor. Multiple security entities have blocked access, including browser extensions and wallet providers, reducing immediate exposure. However, the domain's persistence on hosting infrastructure and its presence on a limited number of blocklists suggest ongoing risk. Users are advised to treat any interaction with this domain as malicious, avoid wallet connections, and verify NFT-related claims through official project channels. Continuous monitoring of related infrastructure is recommended due to the high likelihood of re-emergence under altered domains.