lucky-box4-ruddy[.]vercel[.]app

The domain lucky-box4-ruddy.vercel.app has been identified as a credential theft phishing site and is currently offline. This domain is suspected of attempting to steal user credentials, which can lead to unauthorized access to sensitive accounts and data.

Analysis indicates that the domain has been flagged by 11 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion among the security community. The domain is registered through Tucows Domains Inc. and resolves to the IP address 216.198.79.131, which is located in the United States and is associated with Amazon.com, Inc. (AS16509). The SSL certificate for the domain is issued by Google Trust Services / WR1, which may have been used to lend a false sense of legitimacy to the site. The domain was created on February 21, 2026, and appears on 2 security blocklists, including PhishDestroy and PhishingDB.

Given the current offline status of the domain, the immediate risk is mitigated. However, it is advisable for organizations to monitor for any resurgence of the domain and to ensure that no internal systems have been compromised through previous interactions. Users and network administrators are recommended to block this domain and its associated IP address, and to educate employees on the signs of credential theft phishing attacks. Additionally, a thorough review of security protocols and user credentials should be conducted to identify and remediate any potential vulnerabilities.