nftlucky-box02[.]vercel[.]app

This domain, nftlucky-box02.vercel.app, operates as a crypto drainer designed to siphon cryptocurrency from connected digital wallets without user consent. Analysis indicates the site employs deceptive prompts, often disguised as legitimate NFT or token distribution events, to trick visitors into authorizing transactions that transfer assets to attacker-controlled addresses. The threat is classified as high-risk due to its active status and direct financial impact on victims. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Tucows Domains Inc. and currently resolves to the IP address 64.29.17.67, hosted on Amazon.com, Inc. infrastructure (AS16509). Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious. Additionally, the domain appears on five independent security blocklists, including entries from specialized cryptocurrency threat intelligence sources. The SSL certificate, issued by Google Trust Services, does not mitigate the underlying malicious activity. If interaction with this domain has occurred, immediate action is required to mitigate potential losses. Disconnect any active wallet sessions and revoke all recent smart contract approvals using a trusted blockchain explorer. Scan the device for malware using updated security tools, as the site may have delivered additional payloads. Monitor wallet activity for unauthorized transactions and consider transferring remaining assets to a new, secure wallet address. Report the incident to relevant cryptocurrency platforms and security communities to aid in broader threat mitigation efforts.