mysterybox-gft29[.]vercel[.]app

mysterybox-gft29.vercel.app is an active phishing domain that has been flagged by 17 out of 93 vendors on VirusTotal. The domain, hosted on an Amazon IP in the United States, is associated with a high-risk score of 100/100. Despite its recent creation on February 21, 2026, it has already been detected and listed by multiple public blocklists, including PhishDestroy, Polkadot, and PhishingDB.

The domain's page title, "Deployment Unavailable," suggests it may be in a transitional state or attempting to evade detection by appearing inactive. However, the high number of VirusTotal detections indicates that it is actively engaging in phishing activities. The use of a reputable SSL issuer, Google Trust Services, may be an attempt to lend credibility and deceive potential victims.

PhishDestroy identified this domain on February 26, 2026, just five days after its creation. This rapid detection highlights the efficiency of PhishDestroy's threat intelligence pipeline, which captures emerging threats before they are widely recognized by antivirus databases. The domain's presence on multiple blocklists further underscores its malicious intent, as it likely targets users with phishing schemes that exploit the trust associated with the Vercel platform.