celo-nft-marketplace-nine[.]vercel[.]app

This domain, celo-nft-marketplace-nine.vercel.app, is confirmed to operate as a crypto drainer targeting users of the Celo blockchain ecosystem. Analysis indicates the site mimics legitimate NFT marketplaces to trick victims into connecting wallets, where malicious smart contracts execute unauthorized token transfers. The domain employs no known brand impersonation but leverages the Celo name to establish false credibility. No specific drainer kit has been attributed at this time, though behavioral patterns align with common crypto theft frameworks. Technical indicators reveal the domain was registered through Vercel Inc. on March 13, 2026, an unusual future date suggesting potential domain spoofing or incorrect registry data. It resolves to IP address 64.29.17.131, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious, while it appears on 3 independent security blocklists. The SSL certificate is issued by Google Trust Services (WR1), providing a false sense of legitimacy. Google Safe Browsing status remains unlisted, indicating either recent activation or evasion of detection. The domain remains active as of this report, with no takedown or sinkholing observed. It is currently blocked by at least three security providers, including wallet protection systems and domain reputation services. The high-risk classification stems from its direct financial theft capability and low detection rate, allowing it to evade basic security controls. Users are advised to treat any interaction with this domain as malicious, revoke connected wallet permissions, and monitor transaction histories for unauthorized activity. Infrastructure analysis suggests the operator may rapidly deploy replacement domains, requiring continuous monitoring of related Vercel-hosted subdomains.