mystery-box4-two[.]vercel[.]app

This domain, mystery-box4-two.vercel.app, is actively engaged in brand impersonation targeting OpenSea, a leading non-fungible token (NFT) marketplace. The threat type is classified as high-risk due to its deceptive mimicry of OpenSea’s official branding, including the use of the page title 'OpenSea.io' to mislead users into believing they are interacting with the legitimate platform. As of the latest assessment, the domain remains operational and unresolved, posing an ongoing risk to unsuspecting users. Infrastructure analysis reveals that the domain is registered through Vercel Inc. and resolves to the IP address 64.29.17.3, geolocated within the United States under Amazon.com, Inc.’s autonomous system (AS16509). The SSL certificate is issued by Google Trust Services (WR1), which, while valid, does not mitigate the domain’s malicious intent. The domain has been flagged by 21 out of 95 security vendors on VirusTotal, indicating broad consensus within the cybersecurity community regarding its fraudulent nature. Additionally, it appears on two security blocklists and is actively blocked by at least two major threat intelligence platforms. The combination of these indicators—particularly the VirusTotal detection rate and blocklist presence—provides concrete evidence of its malicious classification. Current status confirms that mystery-box4-two.vercel.app remains active and continues to pose a significant threat. Users and organizations are strongly advised to block access to this domain at the network level and update endpoint protection rules to include this indicator of compromise (IOC). Security teams should monitor for any attempts to access this domain, particularly within environments where cryptocurrency or NFT transactions are conducted. Given the high-risk nature of this threat, immediate action is recommended to prevent potential financial loss or credential theft resulting from interaction with this fraudulent site.