luck-wonder4[.]vercel[.]app

This domain, luck-wonder4.vercel.app, was observed on July 23, 2026 and is currently classified as a generic phishing site with an elevated risk rating. The host resolves to the IP address 64.29.17.131, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain was registered on February 21, 2026 through Tucows Domains Inc., indicating a recent creation date typical of many malicious deployments. HTTPS is served by a certificate issued by Google Trust Services under the WR1 intermediate, confirming that TLS termination is handled by the Vercel platform. An HTTP 451 response code is returned, and the page title reports “Deployment Unavailable,” suggesting that the malicious payload has been taken offline at the time of analysis.

Reputation services have flagged the domain. PhishDestroy and ScamSniffer have added it to their blocklists, and VirusTotal reports that 15 of 93 security vendors label the host as malicious. The presence on multiple blocklists and the multi‑vendor detections reinforce the confidence that the domain was used for phishing, even though the actual content is no longer reachable. No additional intelligence such as Safe Browsing, OTX, or specific brand impersonation is available in the current dataset.

Defenders should continue to block DNS resolution for luck-wonder4.vercel.app and the associated IP 64.29.17.131 at perimeter firewalls and DNS filtering solutions. Monitoring of newly created subdomains under the same registrar (Tucows) and the same hosting ASN (AS16509) is recommended, as attackers frequently spin up fresh Vercel deployments for short‑lived campaigns. Incident response teams should treat any email or credential capture attempts that reference this domain as malicious and advise users to avoid interaction. Ongoing scanning of the certificate fingerprint and periodic re‑query of reputation services will help confirm whether the site is re‑hosted in the future.