lucky-giftbox21[.]vercel[.]app

Analysis of lucky-giftbox21.vercel.app shows that the domain was registered on 21 February 2026 through Tucows Domains Inc. The hosting resolves to 64.29.17.131, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The TLS certificate is issued by Google Trust Services under the WR1 intermediate, indicating a valid HTTPS endpoint at the time of capture. An HTTP 451 response returned the page title “Deployment Unavailable”, and the server reports Vercel and HSTS as detected technologies, consistent with a Vercel‑hosted deployment that has been taken offline. Threat intelligence indicates that 17 of 93 VirusTotal scanners flagged the domain, and the host appears on four external blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura.

The combination of recent creation, rapid blocklisting, and multiple vendor detections aligns with a generic phishing operation, even though the exact lure or credential‑stealing page has not been captured. Uncertainty remains regarding the content that was served before the site was removed; the current “Deployment Unavailable” page provides no further artefacts, and no additional phishing kit fingerprints have been disclosed. Consequently, defenders cannot confirm the specific credential‑capture vector, but the presence of multiple independent detections and blocklist listings justifies a high risk rating.

Defenders should continue to block the domain at perimeter and DNS layers, incorporate the IP address 64.29.17.131 into network threat feeds, and monitor for any re‑use of the same hosting infrastructure. Because the registrar is Tucows, rapid takedown requests may be effective if future activity resurfaces. Maintaining up‑to‑date blocklist subscriptions that include PhishDestroy, Polkadot, Enkrypt, and Codeesura will capture any reappearance.