lucky-giftbox3[.]vercel[.]app

Analysis as of July 24 2026 indicates that the domain lucky-giftbox3.vercel.app was registered on 21 February 2026 through Tucows Domains Inc. The authoritative name resolution points to the IP address 64.29.17.3, which is announced by Amazon.com, Inc. (AS16509) and located in the United States. The host runs Vercel infrastructure and presents an HSTS header, suggesting the site was intended to serve content over HTTPS. The presented TLS certificate is issued by Google Trust Services under the WR1 certificate authority, confirming a legitimate certificate chain. An HTTP request to the root URL returns status code 451, and the page title returned is “Deployment Unavailable,” indicating that the service is currently offline or deliberately withdrawn.

Despite the legitimate‑looking hosting and certificate, the domain has been flagged by multiple security‑focused blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, and appears on four public blocklists. VirusTotal analysis shows that nine of ninety‑five antivirus or URL‑reputation engines have raised a detection, reinforcing the suspicion that the site has been used for malicious activity. The classification supplied in the source data is “generic phishing,” although no specific branded lure or credential‑harvesting page has been observed because the site is not serving content at the time of analysis. The combination of recent registration, use of a cloud‑based Vercel deployment, a valid TLS certificate, and concurrent listings on phishing‑oriented blocklists is a pattern frequently associated with short‑lived phishing campaigns that leverage reputable hosting to evade static URL filters.

Because the site is currently returning a 451 response, active probing of the payload is not possible, leaving the exact phishing vector (e.g., credential‑stealing form, malicious download) unknown.