nftclaims-proj4[.]vercel[.]app

Analysis of nftclaims-proj4.vercel.app shows a high‑risk crypto‑drainer infrastructure that was taken offline as of 24 July 2026. The domain was registered on 21 February 2026 through Tucows Domains Inc. and resolves to IP 216.198.79.67, which belongs to Amazon.com, Inc. (AS16509) located in the United States. TLS is provided by Google Trust Services under the WR1 certificate, and the site enforces HSTS. An HTTP 451 response and the page title “Deployment Unavailable” indicate that the front‑end is deliberately disabled, consistent with the reported offline status.

Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on five independent blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. VirusTotal scans returned 16 detections out of 93 security vendors, confirming malicious intent. The observed technology stack consists of Vercel hosting, which is commonly abused for rapid deployment of malicious pages. The available evidence points to a crypto‑scam campaign designed to lure victims into transferring cryptocurrency, although the specific payload or phishing pages have not been captured.

Uncertainty remains regarding the exact phishing flow, the wallets targeted, and whether any active command‑and‑control infrastructure remains after takedown. Defenders should block the domain and its resolved IP at perimeter defenses, add the listed blocklists to filtering rules, and monitor for any newly created subdomains under the same registrar or ASN. Continuous re‑scanning of the domain on VirusTotal and review of Google Safe Browsing updates are recommended to capture any re‑appearance. Incident response teams should also audit outbound traffic for connections to AS16509 that may correlate with other Vercel‑hosted malicious assets.