minting-box4[.]vercel[.]app

Analysis of minting-box4.vercel.app shows a high‑risk crypto drainer infrastructure that was taken offline prior to the report date of July 23, 2026. The domain was registered on February 21, 2026 through Tucows Domains Inc. and resolves to IP address 64.29.17.3, which belongs to Amazon.com, Inc. (AS16509) located in the United States. The hosting environment is identified as Vercel, and the service enforces HTTP Strict Transport Security (HSTS). The TLS certificate is issued by Google Trust Services under the WR1 label, confirming a valid HTTPS endpoint despite the site being unavailable.

An HTTP 451 response is returned with the page title "Deployment Unavailable," indicating that the content has been intentionally removed or blocked. VirusTotal scans recorded 14 detections out of 93 security vendors, providing independent confirmation of malicious intent. The domain is listed on four security blocklists and has been actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing its classification as a crypto scam.

While the exact payload or phishing page content cannot be examined because the deployment is offline, the convergence of registrar data, hosting details, SSL issuance, vendor detections, and blocklist inclusion strongly supports the designation of a crypto drainer operation. Defenders should continue to deny any network traffic to 64.29.17.3, add minting-box4.vercel.app to local and cloud‑based blocklists, and monitor for any re‑registration attempts or similar Vercel‑hosted subdomains that exhibit the same technical fingerprints. Ongoing telemetry collection from endpoint security solutions is advised to capture any residual artifacts that may have been distributed before the takedown.