mint-nft-box8[.]vercel[.]app

This domain, mint-nft-box8.vercel.app, is identified as a high-risk brand impersonation threat targeting cryptocurrency and NFT users. Analysis indicates the site operated as a fraudulent NFT minting platform, likely designed to deceive victims into connecting digital wallets under false pretenses of exclusive token sales or limited-edition NFT drops. The threat type aligns with known crypto drainer schemes, where malicious smart contracts or wallet-draining scripts are deployed once a user authorizes a transaction. No specific drainer kit variant has been conclusively attributed, though the infrastructure and behavioral patterns match common open-source phishing frameworks used in similar campaigns. Technical indicators confirm the domain's malicious nature. The domain was registered on February 21, 2026, through Tucows Domains Inc., a registrar frequently observed in phishing operations due to its accessibility and bulk registration capabilities. It resolves to the IP address 216.198.79.131, hosted on Amazon Web Services (AS16509), a common infrastructure provider for both legitimate and malicious deployments. At the time of analysis, the domain was detected by 17 out of 95 security vendors on VirusTotal, with five distinct security blocklists—PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB—listing it as malicious. The SSL certificate, issued by Google Trust Services (WR1), provides no inherent trust, as automated certificate issuance is standard for both benign and malicious domains. Google Safe Browsing status was not explicitly provided, but the blocklist presence suggests likely inclusion. The domain is currently offline, displaying a 'Deployment Unavailable' page title, which may indicate takedown by the hosting provider or voluntary suspension by the threat actor. While the immediate threat has been mitigated, residual risk remains for users who may have interacted with the site prior to its deactivation. Historical DNS records and cached content could still pose a risk if accessed through unsecured channels. Users who connected wallets or entered credentials are advised to revoke any active smart contract approvals, transfer assets to new wallets, and monitor for unauthorized transactions. Organizations and individuals should update blocklists to include this domain and its associated IP to prevent future exposure. Continuous monitoring of related infrastructure is recommended, as threat actors often re-deploy similar domains using the same registrar and hosting patterns.