nftlucky-box12[.]vercel[.]app

This domain, nftlucky-box12.vercel.app, is actively distributing a crypto drainer, a type of malware designed to siphon cryptocurrency from compromised wallets. Analysis indicates the threat leverages malicious JavaScript injected into seemingly legitimate web pages, tricking users into authorizing transactions that drain funds. No direct brand impersonation was observed, but the domain mimics common NFT-related services to lure victims. The drainer kit appears to be a variant of the widely tracked 'WalletDrainer' family, though no unique campaign identifier has been assigned beyond the seed f03fdb. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. and currently resolves to the IP address 64.29.17.3, hosted on Amazon.com, Inc. infrastructure (AS16509). The SSL certificate is issued by Google Trust Services (WR1), a common choice for malicious domains due to its low barrier to acquisition. The domain was created on February 21, 2026, and remains active despite being flagged by 5 security blocklists. VirusTotal reports 16 out of 95 security vendors detecting the domain as malicious. While the page title displays 'Deployment Unavailable,' this is likely a decoy, as the underlying infrastructure continues to serve malicious payloads. As of the latest assessment, the domain remains active and unblocked by major browser-based protections, posing a continued risk to users. Response actions by security teams include its inclusion in at least 5 blocklists, though evasion techniques such as rapid domain rotation or IP switching may prolong its operational lifespan. The remaining risk is classified as high due to the direct financial impact of crypto drainers and the domain's persistence. Users are advised to block the domain at the network level, revoke any wallet authorizations associated with it, and monitor for unauthorized transactions. Wallet software updates and browser-based script blockers are recommended to mitigate similar threats.