openopenbox306[.]vercel[.]app

The domain openopenbox306.vercel.app has been confirmed as a crypto wallet phishing endpoint targeting cryptocurrency users. Analysis indicates this is not a generic credential harvester but a specialized attack vector designed to intercept wallet connections and private keys through malicious dApp interfaces. The domain is currently offline, though prior activity suggests it impersonated legitimate wallet services or decentralized application frontends. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, with detections spanning phishing, malware distribution, and fraudulent transaction categories. The endpoint appeared on five distinct security blocklists, including specialized crypto threat intelligence feeds. The domain resolves to IP address 64.29.17.3, hosted on Amazon Web Services (AS16509) infrastructure, and was registered through Vercel Inc. The SSL certificate, issued by Google Trust Services (WR1), shows standard validity periods but provides no inherent trust for the malicious content served. Page metadata returned a 'Deployment Unavailable' title, likely indicating either takedown procedures or backend maintenance during active malicious operations. Current status shows the domain has been taken offline, though the underlying infrastructure remains accessible. Organizations should treat this as a high-risk indicator due to the specialized nature of the threat and prior blocklist inclusion. Recommended actions include adding the domain to internal blocklists, monitoring for DNS resolution attempts, and reviewing logs for connections to 64.29.17.3 or related Vercel subdomains. Security teams should investigate potential wallet drain attempts associated with this endpoint, particularly transactions initiated through dApp browsers or Web3 interfaces. The domain's registration through a legitimate platform hosting service suggests attackers may attempt to redeploy similar endpoints using comparable naming patterns.