lucky-box-english[.]pages[.]dev

Analysis of the domain lucky-box-english.pages.dev indicates it is an active crypto drainer phishing site, first observed on May 4, 2026, and remaining operational as of July 12, 2026. The domain resolves to 172.66.44.178, hosted on infrastructure associated with Cloudflare, Inc. in Canada. It employs a Let's Encrypt SSL certificate (serial E7) and is served over HTTP/3 with HSTS enabled, alongside tracking technologies including Facebook Pixel. The page title 'Lucky Box' suggests a lure promising cryptocurrency rewards or giveaways, aligning with the confirmed scam type of crypto drainer—malware designed to siphon digital assets from victims' wallets. Infrastructure analysis reveals the domain is registered through Cloudflare, using nameservers howard.ns.cloudflare.com and ophelia.ns.cloudflare.com. It has been flagged by one security blocklist, PhishDestroy, and received marginal detection from security vendors, with 2 of 91 engines on VirusTotal identifying it as malicious. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. While the exact content and victim interaction flow remain unanalyzed, the combination of a newly registered domain, confirmed crypto drainer classification, and minimal but present detection signals a credible threat. Defenders should prioritize blocking this domain at the DNS and network level, particularly in environments where cryptocurrency transactions occur. Monitoring for connections to 172.66.44.178 or related Cloudflare-hosted endpoints may help identify compromised systems. Given the domain's use of Cloudflare and Let's Encrypt, takedown efforts may require coordination with both the registrar and hosting provider. No brand impersonation has been confirmed beyond the generic 'Lucky Box' title, so attribution to a specific legitimate service is not currently supported by available evidence.