lckypr[.]com

lckypr.com has been identified as an active crypto-draining phishing site designed to trick users into connecting cryptocurrency wallets and siphon digital assets without consent. This domain is currently under investigation but remains unblocked on VirusTotal with 0 detections out of 95 engines as of seed 644110, indicating a low detection rate that threat actors often exploit before widespread flagging. The site resolves to IP 3.33.188.174 and uses an Amazon-issued SSL certificate to appear legitimate, a common tactic to increase trust among potential victims. This domain was registered through NameSilo, LLC on April 28, 2025, and continues to operate without blocklisting despite growing evidence of malicious intent. VirusTotal’s 1/95 detection ratio suggests a stealthy launch phase, while the lack of prior domain history increases the risk of successful phishing campaigns targeting cryptocurrency users. The age of the domain is particularly concerning, as newly created domains are frequently repurposed for malicious campaigns within days of registration. Users who have visited lckypr.com should immediately disconnect any connected cryptocurrency wallets and revoke permissions through wallet interfaces. Run a full system scan using updated antivirus software and clear browser cache and cookies related to the domain. Report the domain to PhishDestroy for further analysis and avoid interacting with any pop-ups or prompts linked to lckypr.com. Exercise heightened caution with unsolicited links promising rewards or urgent actions, especially those involving crypto transactions.