nftlucky-box08[.]vercel[.]app

Analysis of nftlucky-box08.vercel.app, created on 21 February 2026 and currently returning HTTP 451 with the page title "Deployment Unavailable", shows that the site is deliberately taken offline, a tactic often used after a short‑lived phishing campaign. The domain resolves to 216.198.79.195, an Amazon.com, Inc. address (AS16509) hosted in the United States. Hosting metadata indicates the presence of Vercel services and HTTP Strict Transport Security, confirming the infrastructure belongs to the Vercel cloud platform. The TLS certificate is issued by Google Trust Services under the WR1 certificate authority, providing a valid HTTPS connection despite the site’s inactivity.

Security intelligence places the domain on four external blocklists (PhishDestroy, Polkadot, Enkrypt, Codeesura) and VirusTotal records show 16 of 93 scanners flagging the host as malicious. The observed scam classification is an NFT‑related crypto drainer, consistent with the "NFT Scam" label in the data. Registration was performed through Tucows Domains Inc., a common registrar for disposable or short‑term malicious domains. What remains uncertain is the exact payload or transaction flow that was used to drain cryptocurrency, as the site content is no longer reachable and no sandbox analysis is available.

No public Safe Browsing or Open Threat Exchange entries are cited, so defenders cannot rely on community‑wide reputation scores beyond the listed blocklists and VirusTotal detections. Defenders should proactively block the IP address 216.198.79.195 and any future subdomains under the same ASN, monitor for newly registered "*.vercel.app" domains that exhibit similar creation dates, and enforce DNS filtering for the four blocklists that already list this domain.