jupnft-xxo[.]vercel[.]app

The domain jupnft-xxo.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. It resolves to the Amazon-owned IP address 216.198.79.195, which is part of ASN 16509 (Amazon.com, Inc.) and is located in the United States. Infrastructure analysis shows the site is hosted on Vercel and serves a valid SSL certificate issued by Google Trust Services under the WR1 authority, with HTTP Strict Transport Security (HSTS) enabled. An HTTP request to the root URL returns a 404 status code and the page title "404: NOT_FOUND," indicating that the public-facing content is currently unavailable. The domain has been flagged on a single security blocklist and is listed by PhishDestroy as a known malicious entry.

VirusTotal records indicate that the domain was scanned by 93 antivirus and URL‑reputation vendors, none of which reported a malicious detection at the time of scanning. Despite the lack of vendor detections, the presence on a blocklist and the classification as an NFT‑related crypto drainer suggest a high‑confidence malicious intent. The site is presently taken offline, and its risk level remains under investigation.

Uncertainties include the exact payload or wallet‑stealing mechanisms that may have been hosted while the site was active, as no content has been captured for forensic analysis. Defenders should continue to block the domain at network perimeter devices, monitor for any resurgence of the domain or associated IP addresses, and incorporate the domain hash into threat‑intelligence feeds. Analysts are advised to watch for new registrations that reuse the same subdomain pattern or Vercel hosting configuration, as attackers often recycle infrastructure to target similar crypto‑focused audiences.