luckymusk[.]com

PhishDestroy identifies luckymusk.com as a live Musk-branded phishing domain currently under active investigation for hosting a fraudulent crypto giveaway scam designed to harvest wallet credentials and seed phrases. The threat type is generic_phishing with no confirmed drainer kit attribution at this stage, but the site mimics Elon Musk’s branding to deceive users into connecting wallets or submitting private keys. The domain appears to be a newly established trap, registered through CNOBIN INFORMATION TECHNOLOGY LIMITED, with no prior reputation or established infrastructure.

This domain exhibits multiple technical red flags: it carries a valid Let’s Encrypt SSL certificate, resolving cleanly to IP 188.114.96.3, and was created on February 23, 2026. VirusTotal currently shows 12/95 detections, indicating it remains undetected by most antivirus engines as of seed 1a8a38. Google Safe Browsing (GSB) status is not flagged, and no public blocklists currently include it. The domain’s newness and clean VT score suggest it is either newly deployed or carefully crafted to evade detection during its initial campaign phase.

As of this report, luckymusk.com remains active and poses a moderate but evolving risk. Immediate user action is required: avoid visiting the site, do not connect wallets, and report any encountered links. Security teams should block the domain at the network perimeter and monitor for associated wallet addresses. While the risk level is currently marked as 'under_investigation,' the lack of detections and active status warrant heightened caution. Users are advised to verify URLs via official channels and enable transaction simulation tools before signing any crypto transactions. Remaining risk is assessed as 'active' and likely to increase as the campaign matures.