lucky-giftbox22[.]vercel[.]app

Analysis of lucky-giftbox22.vercel.app shows a newly registered Vercel‑hosted site that has been flagged as a high‑risk generic phishing domain. The domain was created on 21 February 2026 through Tucows Domains Inc. and resolves to the Amazon‑owned IP address 216.198.79.3 (AS16509, United States). An HTTPS certificate issued by Google Trust Services (CN=WR1) is present, and the server returns HTTP status 451 with the page title “Deployment Unavailable”.

Vercel and HSTS headers were detected, confirming the use of Vercel’s hosting platform. VirusTotal scans returned 12 detections out of 93 antivirus engines, and the domain appears on four independent blocklists, including PhishDestroy, Polkadot, Enkrypt and Codeesura. The site is currently taken offline, which limits payload observation; no page content beyond the “Deployment Unavailable” title has been captured, and the specific phishing lure remains unknown.

Infrastructure clues—the use of a legitimate cloud provider, a recent registration date, and a short‑lived TLS certificate—are consistent with abuse patterns observed in other phishing campaigns that exploit trusted hosting services to evade naïve URL filtering. Defenders should immediately block the domain at DNS and proxy layers, add the associated IP address 216.198.79.3 to threat‑intel feeds, and monitor for re‑use of the Vercel deployment identifier. Continuous re‑scanning on VirusTotal and periodic verification of blocklist status are advised, as the site may be resurrected and used to host credential‑stealing pages.