passport-score-nft[.]vercel[.]app

This domain, passport-score-nft.vercel.app, is identified as a crypto drainer operation targeting users through deceptive non-fungible token (NFT) or wallet interaction prompts. Analysis indicates no direct brand impersonation, but the infrastructure aligns with known drainer kits designed to siphon cryptocurrency assets via malicious smart contract interactions. The domain leverages a Vercel-hosted frontend, a common tactic to exploit reputable cloud providers for rapid deployment and evasion of detection. No specific drainer kit variant has been attributed at this stage, though the 404 response suggests either a takedown or intentional obfuscation of active malicious content.

Technical indicators confirm high-risk classification: VirusTotal reports 10 out of 95 security vendors flagging the domain, with detections spanning phishing, malicious scripts, and crypto-related fraud. The domain was registered through Tucows Domains Inc. on February 21, 2026, an unusually future-dated creation that may indicate registry manipulation or a placeholder for imminent malicious activity. It resolves to IP address 64.29.17.195, hosted under Amazon.com, Inc. (AS16509) in the United States. Google Safe Browsing explicitly flags the domain as phishing, and it appears on at least one security blocklist, specifically PhishDestroy. The SSL certificate is issued by Google Trust Services (WR1), a legitimate provider, which further complicates detection by blending with benign traffic.

As of the latest assessment, the domain is offline, returning a 404: NOT_FOUND status, likely due to takedown actions by the hosting provider or domain registrar. However, residual risk persists due to the domain’s registration remaining active and the infrastructure’s potential for rapid redeployment. Users who interacted with the domain prior to takedown may still be exposed to wallet-draining scripts or secondary payloads. Recommended mitigation includes revoking permissions for any connected wallets, monitoring transaction histories for unauthorized activity, and blocking the domain and associated IP addresses at the network level. Organizations should update endpoint protection rules to include the domain’s hash signatures and SSL certificate thumbprint for retrospective detection.