lucky-box25[.]vercel[.]app

The domain lucky-box25.vercel.app has been identified as a high-risk credential theft operation. This domain, which was created on February 21, 2026, utilizes infrastructure that potentially targets sensitive user credentials. It does not currently impersonate any specific brand, nor is there evidence of a drainer kit associated with cryptocurrency. However, the high number of security vendor detections indicates malicious intent related to phishing activities.

Technical analysis of lucky-box25.vercel.app reveals several concerning indicators. VirusTotal scores this domain at 17/95, reflecting detection by multiple security vendors. This domain was registered through Tucows Domains Inc., and resolves to the IP address 64.29.17.195, located in the United States managed by Amazon.com, Inc. Google's Safe Browsing has flagged this domain as phishing, and it appears on five distinct security blocklists including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. The SSL certificate is issued by Google Trust Services WR1, which potentially lends unwarranted legitimacy to the site.

Currently, lucky-box25.vercel.app is offline, reducing the immediate risk to users. However, the threat level remains high due to its previous activity and the potential for reactivation under new infrastructure. Organizations and individuals are advised to update blocklists and security measures to prevent similar phishing threats. Continuous monitoring for domains with similar characteristics or registration patterns can help mitigate future risks. Awareness and education on the dangers of credential theft should be reinforced among users to prevent data compromise.