livaction-mintgft15[.]vercel[.]app

Analysis of the domain livaction-mintgft15.vercel.app indicates a high-risk phishing campaign impersonating OpenSea, a well-known NFT marketplace. The domain was registered on December 1, 2025, through Vercel Inc. and resolves to the IP address 216.198.79.67, hosted on Amazon.com, Inc.'s infrastructure (AS16509) in the United States. The page title explicitly displays 'OpenSea.io,' suggesting an attempt to deceive users into believing they are interacting with the legitimate platform. The domain was flagged by five security blocklists and is currently offline, returning an HTTP 451 status code. Detection engines such as PhishDestroy, ScamSniffer, Polkdot, Enkrypt, and Codeesura have classified this as a crypto scam, specifically linked to an NFT mint phishing kit.

The SSL certificate is issued by Google Trust Services (WR1), a common feature in phishing domains leveraging legitimate certificate authorities to appear trustworthy. VirusTotal reports that 20 out of 95 security vendors have flagged this domain, reinforcing its malicious classification. The use of Vercel's hosting platform and HSTS technology further aligns with observed tactics in phishing campaigns, where attackers exploit reputable services to evade initial scrutiny. Nameserver information is absent (NS_NOT_FOUND), which may indicate an incomplete or hastily deployed infrastructure.

Defenders should treat this domain as confirmed malicious. Network-level blocks should be implemented for the IP 216.198.79.67, and monitoring should extend to other domains registered through Vercel Inc. that exhibit similar naming patterns or resolve to the same infrastructure. Given the domain's association with an NFT mint phishing kit, users should be alerted to the risks of interacting with unverified NFT minting pages, particularly those impersonating OpenSea. The current offline status does not preclude future reactivation, necessitating ongoing vigilance.