nft-luckybox5-five[.]vercel[.]app

This domain, nft-luckybox5-five.vercel.app, operates as a crypto drainer, a type of malicious infrastructure designed to automatically siphon cryptocurrency from connected wallets. Victims are typically lured through deceptive promotions, such as fake NFT giveaways or token airdrops, which trick users into authorizing transactions that grant attackers access to their funds. Once connected, the drainer executes unauthorized transfers, often irreversibly depleting wallet balances without the user's knowledge. The threat is particularly severe due to the irreversible nature of cryptocurrency transactions and the lack of recourse for victims. Analysis indicates this domain is part of a confirmed malicious campaign. It was registered through Tucows Domains Inc. on February 21, 2026, an unusually future-dated creation that suggests domain spoofing or registry manipulation. The site resolves to IP address 216.198.79.3, hosted on Amazon Web Services (AS16509), and is currently offline with a page title reading 'Deployment Unavailable.' Security vendors on VirusTotal flagged this domain 17 out of 95 times, and it appears on five independent blocklists, including those maintained by blockchain security entities. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the risk, as malicious actors frequently abuse legitimate certificate authorities to lend false credibility to phishing sites. Users who interacted with nft-luckybox5-five.vercel.app should take immediate action to secure their assets. First, revoke any active wallet authorizations granted to the domain using a blockchain explorer or wallet interface. Next, transfer remaining funds to a new, secure wallet address not previously exposed to the site. Monitor transaction histories for unauthorized activity and report the incident to relevant security platforms for further investigation. Given the high-risk nature of crypto drainers, affected users should also consider reporting the domain to their wallet provider and local cybercrime authorities to aid in tracking the threat actors.