connect-punch[.]com

Analysis of connect-punch.com, observed as offline as of 24 July 2026, shows several indicators consistent with a phishing operation targeting cryptocurrency airdrop participants. The site presented the HTML title "$PUNCH - The Sanctuary Monkey", which aligns with the known airdrop‑scam kit identified in prior threat‑intel. No TLS certificate was observed, indicating the site served only over HTTP. Domain registration occurred on 23 February 2026 through NiceNIC International Group Co., Limited, and the authoritative name servers are ns1.vercel-dns.com and ns2.vercel-dns.com, a pair commonly used by benign Vercel‑hosted applications but also repurposed by malicious actors.

The domain resolves to the IPv4 address 216.198.79.1, an Amazon.com, Inc. host (AS16509) located in the United States. This IP has appeared on three security blocklists and is listed by the PhishDestroy, MetaMask, and SEAL blocklisting services. VirusTotal scans reported three detections out of ninety‑three antivirus engines, reinforcing the malicious classification. The page title, kit name, and blocklist presence collectively confirm that the infrastructure was employed for an airdrop‑related phishing campaign.

Uncertainty remains regarding the exact content delivered to victims because the site is no longer reachable, and no SSL/TLS fingerprint or HTTP response codes are available for further verification. Defenders should continue to block the domain and its associated IP address at network perimeters, update URL filtering and security‑aware browsing controls, and monitor for any future re‑registrations of the same name or similar sub‑domains. Additional telemetry from endpoint protection solutions that reference the three VirusTotal detections can aid in correlating compromised systems. Ongoing observation of the registrar NiceNIC and the Vercel DNS infrastructure is recommended, as these components have been leveraged in prior malicious campaigns.