nft-luckybox20-pi[.]vercel[.]app

Domain nft-luckybox20-pi.vercel.app is assessed as a crypto_drainer infrastructure impersonating a reward-based NFT “lucky box” style landing page. Analysis indicates a wallet-draining campaign pattern designed to trigger signature approvals and asset transfer permissions under deceptive reward claims. The structure suggests a single-page deployment optimized for rapid rotation and short lifespan abuse.

Technical indicators show 17/95 security vendors flagging the domain as malicious, with resolution to IP 64.29.17.131 hosted on a large US cloud provider ASN (AS16509). Domain registration date is February 21, 2026, indicating a recently created infrastructure consistent with disposable phishing/drainer deployments. The TLS certificate is issued by a major cloud certificate authority under a WR1 profile. The domain is also present across 5 independent security blocklists, reinforcing cross-source detection consistency.

Current status shows the deployment is offline and returning an unavailable page, suggesting takedown or suspension of hosting instance. Despite this, historical resolution data and prior detections indicate continued residual risk due to potential rapid redeployment under alternate subdomains or cloned infrastructures. Defensive actions include continued monitoring for reappearance, blocking of related IP ranges, and enforcement of wallet transaction signature warnings to mitigate crypto asset theft attempts. Users previously exposed may remain at risk of credential or wallet approval phishing chains even after endpoint removal.