nft-luckybox3-nine[.]vercel[.]app

This domain, nft-luckybox3-nine.vercel.app, is identified as a crypto drainer, a type of malicious infrastructure designed to siphon cryptocurrency from connected digital wallets. Crypto drainers operate by tricking users into signing transactions that grant attackers access to their wallet funds, often through deceptive prompts or fake token approvals. Once permissions are granted, the drainer silently transfers assets to attacker-controlled addresses, leaving victims with irreversible losses. The threat is particularly insidious because it exploits legitimate blockchain interactions, making detection difficult for average users. Analysis indicates this domain was registered on February 21, 2026, through Tucows Domains Inc., and is currently flagged by 17 out of 95 security vendors on VirusTotal. Infrastructure analysis reveals the domain resolves to the IP address 64.29.17.67, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate is issued by Google Trust Services (WR1), a common tactic to lend false legitimacy. The domain appears on five security blocklists, including PhishDestroy and Polkadot, and is explicitly labeled as phishing by Google Safe Browsing. The page title, 'Deployment Unavailable,' suggests an attempt to mask malicious activity behind a seemingly benign error message. If you visited this domain or interacted with its content, immediate action is required. First, disconnect any wallets linked to the site and revoke all token approvals using a blockchain explorer or wallet management tool. Review recent transactions for unauthorized transfers and monitor connected accounts for suspicious activity. Consider migrating funds to a new wallet if permissions were granted. Report the domain to relevant security platforms to aid in broader threat mitigation. Users should also scan their devices for malware, as crypto drainers may deploy additional payloads to maintain persistence or harvest sensitive data.