mint-nftbox20-three[.]vercel[.]app

The domain mint-nftbox20-three.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. and is hosted on Amazon's infrastructure (AS16509) at IP address 216.198.79.195, located in the United States. The site presents a TLS certificate issued by Google Trust Services under the WR1 identifier, indicating a valid HTTPS configuration, and the server enforces HTTP Strict Transport Security. An HTTP request to the root URL returns status code 451, and the page title returned is "Deployment Unavailable," suggesting that the original application has been taken offline.

VirusTotal analysis shows that 13 of 93 scanning engines flagged the domain, and Google Safe Browsing classifies it as a social engineering threat. The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, reinforcing its malicious reputation. Automated fingerprinting identified Vercel as the underlying platform, consistent with the subdomain structure.

The overall risk rating is high, and the current operational status is offline, indicating that the malicious infrastructure may have been temporarily disabled or is in the process of being dismantled. Defenders should continue to monitor the IP address 216.198.79.195 for any reactivation, block the domain at DNS and proxy layers, and update internal threat intel feeds with the observed indicators, including the TLS certificate fingerprint, HTTP status, and blocklist listings. Because the page content is not available, the precise phishing payload or cryptocurrency draining mechanism remains uncertain; however, the combination of a crypto‑focused scam classification, reputable hosting, and active blocklist entries warrants proactive containment and continued surveillance.