lucky-giftbox7[.]vercel[.]app

This domain is flagged as a high-risk crypto drainer phishing operation targeting cryptocurrency wallet users. Analysis indicates the site impersonates legitimate crypto reward or airdrop campaigns, tricking victims into connecting wallets to malicious smart contracts that drain funds. The threat type is classified as a crypto asset theft mechanism, leveraging social engineering to exploit user trust in seemingly official promotions. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Tucows Domains Inc., an unusual registrar choice for phishing domains. It resolves to IP address 64.29.17.195, hosted on Amazon Web Services (AS16509) in the United States. The domain appears on five security blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. VirusTotal detection shows 18 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WR1), and the page currently displays a 'Deployment Unavailable' status, suggesting recent takedown or operational disruption. Mitigation requires immediate action from cryptocurrency users and security teams. Users should verify all crypto reward offers through official project channels and never connect wallets to unverified websites. Security teams should block the domain and associated IP at the network level, monitor for related phishing domains using the same registrar or hosting infrastructure, and deploy endpoint protection rules to detect wallet-draining scripts. Wallet providers should flag transactions originating from interactions with this domain as high-risk and alert users. Given the domain's presence on multiple blocklists, organizations should cross-reference internal logs for any prior connections to this infrastructure.