nftlucky-box01[.]vercel[.]app

nftlucky-box01.vercel.app is a high-risk domain identified as a crypto drainer. The domain does not appear to target any specific brand but is part of a broader campaign designed to siphon cryptocurrency from unsuspecting users. The infrastructure used for this campaign suggests a sophisticated operation, leveraging reliable hosting and domain registration services to carry out the attacks.

Analysis indicates that the domain has been flagged by 17 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection by automated systems. The domain is registered through Tucows Domains Inc., a reputable registrar, and resolves to the IP address 216.198.79.3, which is located in the United States and attributed to Amazon.com, Inc. (AS16509). The domain was created on February 21, 2026, and currently displays a 'Deployment Unavailable' page title. The SSL certificate is issued by Google Trust Services / WR1. The domain also appears on five known security blocklists, including PhishDestroy, Polkadot, Enkrypt, and PhishingDB.

The domain is currently offline, which may indicate that it has been taken down by security measures or that the operators are preparing for a new phase of the campaign. Despite the offline status, the fact that it is flagged by multiple security vendors and appears on several blocklists suggests a significant risk. It is recommended that users avoid accessing this domain and that security teams monitor for any signs of reactivation. The remaining risk includes potential reinfection vectors or the use of similar infrastructure for future attacks.