lucky-giftbox18[.]vercel[.]app

The domain lucky-giftbox18.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. and is currently hosted on Amazon’s infrastructure (AS16509) in the United States, resolving to IP address 64.29.17.131. The site presents an HTTP 451 response with the page title "Deployment Unavailable" and serves a TLS certificate issued by Google Trust Services under the WR1 certificate authority. VirusTotal analysis recorded ten of ninety‑three security vendors flagging the domain as malicious, and the domain is listed on four independent blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura.

The presence of Vercel platform identifiers and HSTS enforcement indicates the site leveraged a legitimate cloud service to host the malicious payload. As of the report date, July 24, 2026, the domain has been taken offline, but the historical evidence suggests a high‑risk generic phishing operation. While the specific brand or service being impersonated has not been identified in the available intelligence, the combination of a newly created domain, rapid detection by multiple vendors, and inclusion on several blocklists warrants a high confidence rating for malicious intent.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration attempts, and correlate any related traffic with the observed IP address and certificate fingerprint. Additional investigation of any payloads or URLs referenced in the original deployment would be required to fully characterize the phishing kit, but the current indicators are sufficient to justify preventive controls and incident response escalation.