mintluckiest32[.]vercel[.]app

Analysis of mintluckiest32.vercel.app shows a high‑risk crypto‑drainer infrastructure that was taken offline prior to the report date of July 23, 2026. The domain was registered on February 21, 2026 through Tucows Domains Inc. and resolves to the Amazon Web Services address 64.29.17.195, which belongs to AS16509 (Amazon.com, Inc.) and is geolocated in the United States. The site served an HTTP 451 status code and presented the page title "Deployment Unavailable," indicating that the front‑end was deliberately disabled. TLS termination is provided by Google Trust Services under the WR1 certificate, and the host header reveals the use of Vercel hosting with HTTP Strict Transport Security (HSTS) enforced.

Security telemetry flags the domain on four independent blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, confirming consensus among threat‑intelligence feeds that the domain was associated with malicious activity. VirusTotal scanned the domain and recorded 17 detections out of 95 scanning engines, reinforcing the malicious assessment. The combination of a recent registration, AWS hosting, Vercel deployment, and a valid Google certificate is a common pattern for fast‑deployment crypto‑drainer campaigns that aim to lend legitimacy while siphoning funds.

Because the site is currently offline, the specific payload or phishing page content cannot be observed, leaving the exact method of credential or wallet compromise uncertain. Defenders should immediately block the domain and its resolved IP address at network perimeters, add the domain to internal threat‑intel watchlists, and monitor for any re‑use of the underlying AWS IP range in future campaigns. Continuous re‑evaluation of the blocklist status and periodic re‑scans of the domain are recommended to detect any resurrection attempts.