luckyboost[.]win

This domain, luckyboost.win, is identified as a cryptocurrency credential harvesting site targeting users through deceptive wallet connection prompts and fake token airdrop offers. Analysis indicates the infrastructure was designed to mimic legitimate blockchain reward platforms, tricking visitors into disclosing private keys or seed phrases under the guise of exclusive crypto distributions. The domain’s content and behavior align with a broader trend of phishing campaigns exploiting decentralized finance (DeFi) hype cycles, particularly those involving newly launched or low-liquidity tokens. Infrastructure analysis reveals the domain was registered on March 13, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The site resolves to the IP address 69.5.189.54, which has been linked to multiple phishing operations in recent months. Detection metrics further confirm its malicious nature: 8 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on three independent security blocklists. The page title, 'luckyboost.win,' lacks obfuscation, suggesting the operators prioritized rapid deployment over evasion techniques. Users who interacted with luckyboost.win should immediately revoke any wallet permissions granted to the site and transfer assets to a new, secure wallet. All credentials or private keys entered on the domain must be considered compromised. Affected individuals are advised to monitor their wallets for unauthorized transactions and report the incident to relevant blockchain security teams. Given the domain’s elevated risk level and prior takedown status, residual redirects or cached pages may persist; users should clear browser data and verify the legitimacy of any linked platforms before re-engaging with cryptocurrency services.