nftlucky-box09[.]vercel[.]app

This domain, nftlucky-box09.vercel.app, operates as a crypto drainer designed to siphon cryptocurrency assets from connected digital wallets. Analysis indicates the site employs deceptive smart contract interactions or malicious transaction prompts to trick users into authorizing unauthorized fund transfers, a tactic increasingly observed in targeted attacks against decentralized finance (DeFi) participants. The domain mimics legitimate NFT or token distribution platforms, leveraging urgency-driven messaging (e.g., "limited-time offers") to exploit victims before they detect the fraudulent activity. Once permissions are granted, the drainer executes automated scripts to empty wallet balances without further user consent, often targeting multiple blockchain networks simultaneously to maximize impact. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to IP address 216.198.79.67, hosted on Amazon Web Services (AS16509), and presents a "Deployment Unavailable" page title, likely a placeholder or fallback state for the malicious payload. It is flagged by 16 out of 95 security vendors on VirusTotal, with additional listings on five specialized blocklists, including those maintained by blockchain security providers. The domain was registered on February 21, 2026, through Tucows Domains Inc., and uses an SSL certificate issued by Google Trust Services (WR1), a common tactic to appear legitimate. The unique seed identifier 8b8ef4 further distinguishes this campaign from other active threats, suggesting coordinated deployment across multiple domains. Users who have interacted with nftlucky-box09.vercel.app should immediately revoke all active smart contract approvals associated with the wallet used on the site. This can be done via blockchain explorers or dedicated revocation tools, ensuring no residual permissions remain. Next, transfer remaining assets to a new, secure wallet address not previously exposed to the domain. Monitor transaction histories for unauthorized activity and report the incident to relevant blockchain security teams or community alert platforms. If private keys or seed phrases were entered, consider the wallet compromised and avoid reusing it. Organizations should update internal blocklists to include this domain and its associated IP, while users should verify all future NFT or token claims through official project channels only.