lucky-giftbox8[.]vercel[.]app

This domain, lucky-giftbox8.vercel.app, operates as a fraudulent reward portal designed to harvest user credentials and personal information. Analysis indicates the site mimics legitimate promotional campaigns, presenting fake surveys or prize claims to deceive visitors into submitting sensitive data. The infrastructure leverages social engineering tactics, often redirecting users through seemingly innocuous prompts that escalate to credential requests or financial scams. Such campaigns frequently target users across multiple platforms, including messaging apps and social media, amplifying their reach and effectiveness. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 21, 2026, an unusually future-dated creation that may indicate automated or bulk registration practices. It resolves to the IP address 216.198.79.195, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The domain appears on four security blocklists, including PhishDestroy and Polkadot, and is flagged by 11 out of 95 security vendors on VirusTotal. The SSL certificate, issued by Google Trust Services (WR1), provides a veneer of legitimacy while failing to mitigate the underlying malicious intent. The page title 'Deployment Unavailable' suggests the site may have been hastily taken offline or is part of a larger, ephemeral phishing operation. Users who visited lucky-giftbox8.vercel.app should immediately cease all interaction with the domain and any associated links. Those who entered credentials or personal information should reset passwords for all potentially compromised accounts, prioritizing financial and email services. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized transactions or login attempts, and report any anomalies to the respective service providers. Security teams should update blocklists to include this domain and its resolving IP address, while users should verify the legitimacy of any unexpected reward offers before engaging with them.