nft-luckybox5-seven[.]vercel[.]app

The domain nft-luckybox5-seven.vercel.app was registered on 21 February 2026 through Tucows Domains Inc. It resolves to the Amazon Web Services address 216.198.79.131, an IP owned by ASN 16509 (Amazon.com, Inc.) located in the United States. The hosting platform is identified as Vercel, and the site presents HTTP Strict Transport Security (HSTS) headers. The TLS certificate is issued by Google Trust Services under the WR1 label, indicating a valid HTTPS endpoint despite the site being taken offline. An HTTP 451 response was observed, and the page title returned by the server is “Deployment Unavailable,” which is consistent with Vercel’s default page when a deployment has been removed or blocked.

Security telemetry shows the domain listed on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—each of which classified the site as a malicious NFT‑related scam. VirusTotal analysis recorded detections by 16 of 93 scanning engines, reinforcing the malicious rating. The intelligence source tags the activity as an “NFT Scam” and, given the reported threat type of a crypto drainer, the operational goal is likely to lure victims into transferring cryptocurrency or NFTs to a controlled wallet. Current status is offline, but the infrastructure footprint (AWS IP, Vercel hosting, Google‑issued certificate) remains reusable for future campaigns.

Defenders should continue to block the domain and its resolved IP at perimeter firewalls and DNS resolvers, monitor for newly created subdomains under vercel.app that reference similar “luckybox” or “nft” patterns, and enforce strict outbound transaction controls for cryptocurrency movements. Regular re‑scanning of the domain and associated IP is advised, as the site could be re‑activated or cloned with minimal changes. The combination of recent registration, reputable hosting, legitimate TLS, and multiple blocklist entries makes this a high‑risk indicator for ongoing NFT‑drainer operations.