zama-og-nft[.]vercel[.]app

This domain is classified as a high-risk crypto drainer, designed to siphon cryptocurrency from connected wallets under the guise of an NFT claim. The page title, 'Zama OG NFT Claim,' mimics legitimate airdrop or minting events to deceive users into authorizing malicious transactions. Analysis indicates this infrastructure is actively targeting individuals with false promises of exclusive digital assets, a common tactic in wallet-draining schemes. Infrastructure analysis reveals the domain was registered through Vercel Inc. on March 07, 2026, and resolves to the IP address 216.198.79.67, hosted on Amazon.com, Inc. (AS16509) in the United States. The SSL certificate is issued by Google Trust Services (WR1), a common provider for both legitimate and malicious sites. Detection metrics show 1 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. The unique seed identifier for this campaign is ff15c2, which may correlate with other known drainer deployments. Mitigation against this threat requires strict verification of NFT claim pages before connecting wallets. Users should cross-reference official project channels for legitimate airdrop announcements and avoid interacting with domains hosted on platforms like Vercel unless explicitly linked from verified sources. Wallet software with transaction simulation or revoke tools can help identify and block unauthorized spending approvals. Given the domain's active status and low detection rate, manual inspection of smart contract interactions is advised to prevent asset loss.