mysterousr1[.]vercel[.]app

Analysis of the domain mysterousr1.vercel.app indicates it was actively flagged as a phishing site targeting OpenSea users, based on observable technical evidence. The domain was hosted on Vercel infrastructure and resolved to the IP address 76.76.21.9, associated with Amazon.com, Inc. (AS16509) in the United States. The page title, 'Drop | OpenSea,' suggests an attempt to mimic the legitimate OpenSea platform, though the exact content and mechanics of the phishing scheme remain unconfirmed due to the domain's current offline status. The domain was registered through Tucows Domains Inc. on February 21, 2026, and has since been taken offline, returning an HTTP 451 status code at the time of this report.

Security vendors have flagged the domain, with 8 out of 93 engines on VirusTotal detecting it as malicious. Additionally, it appears on three security blocklists, and was blocked by PhishDestroy, ScamSniffer, and Enkrypt. The SSL certificate was issued by Google Trust Services (WR1), a common certificate authority that does not inherently indicate legitimacy in this context. Infrastructure analysis reveals the use of HSTS, a security feature that may have been employed to lend an appearance of authenticity.

However, the combination of hosting on a platform frequently abused for phishing (Vercel), the domain's registration details, and its detection by multiple security vendors strongly supports the classification of this as a phishing campaign. Defenders should treat this domain as compromised and continue monitoring for related infrastructure, particularly any reuse of the IP or registrar for future malicious activity. Given its current offline status, further forensic analysis may be limited, but historical DNS and WHOIS records could provide additional context for tracking related threats.