luckiestmint20[.]vercel[.]app

On 24 July 2026, the domain luckiestmint20.vercel.app was observed being used as a crypto‑drainer site. The domain was registered on 21 February 2026 through Tucows Domains Inc., and its DNS resolves to the IP address 64.29.17.195, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site is hosted on the Vercel platform, as indicated by the technology fingerprint, and serves an SSL certificate issued by Google Trust Services under the WR1 certificate authority. HTTPS responses include HTTP Strict Transport Security (HSTS), suggesting an attempt to enforce secure connections. When accessed, the server returned HTTP status 451 with the page title “Deployment Unavailable,” indicating that the Vercel deployment has been taken offline.

Despite the offline state, the domain continues to appear on two independent blocklists (PhishDestroy and ScamSniffer) and is flagged by Google Safe Browsing for social engineering. VirusTotal analysis shows that 16 of 93 scanning engines flagged the domain as malicious, reinforcing the suspicion of a crypto‑draining operation. The combination of a recent registration date, use of a reputable cloud provider, a valid Google‑issued TLS certificate, and the presence on multiple security blocklists aligns with known patterns of crypto‑drainer campaigns that exploit the trust of cloud services to lure victims. However, because the site is currently offline, the exact payload, phishing pages, or wallet addresses targeted are not publicly observable, leaving the specific attack vector uncertain.

Defenders should continue to block luckiestmint20.vercel.app at network perimeter and DNS filtering layers, and monitor the associated IP 64.29.17.195 for any future re‑activation.