luck-wonder3[.]vercel[.]app

This domain, luck-wonder3.vercel.app, operates as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. The site mimics trusted platforms, presenting fraudulent login interfaces that capture usernames, passwords, and potentially multi-factor authentication codes. Analysis indicates the domain targets users through deceptive links distributed via email, social media, or messaging platforms, exploiting perceived legitimacy due to its hosting on a widely recognized platform. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Tucows Domains Inc., a detail inconsistent with typical legitimate service timelines. The site resolves to IP address 64.29.17.131, hosted within Amazon.com, Inc.'s AS16509 network in the United States. Security vendor assessments confirm its malicious nature, with 16 out of 95 detection engines flagging the domain on VirusTotal. Additionally, the domain appears on three independent security blocklists and is actively blocked by multiple threat intelligence platforms, including those specializing in real-time phishing detection. Users who have visited luck-wonder3.vercel.app or entered credentials on the site should immediately take corrective action. First, revoke access to any accounts that may have been compromised and update passwords using a secure, unrelated device. Enable multi-factor authentication where available, preferably using an authenticator app rather than SMS-based methods. Monitor linked accounts for unauthorized activity, including financial transactions or changes to account settings. If the site was accessed on a work device, report the incident to internal security teams to prevent potential lateral movement within the network. Finally, avoid interacting with any communications or links associated with this domain, as they may lead to further compromise.