nftlucky-box2[.]vercel[.]app

This domain, nftlucky-box2.vercel.app, operates as a crypto drainer designed to illicitly extract digital assets from connected cryptocurrency wallets. Analysis indicates the site employs deceptive prompts to trick users into authorizing transactions, which then silently transfer funds to attacker-controlled addresses. The threat specifically targets wallet credentials and transaction signatures, enabling unauthorized asset drainage without immediate detection by victims. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to IP address 216.198.79.67 within Amazon.com, Inc.'s AS16509 network and appears on six distinct security blocklists. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing classifies it as phishing. Registered through Tucows Domains Inc. on February 21, 2026, the domain exhibits an anomalous creation date, suggesting potential domain squatting or preemptive registration for malicious purposes. Additional blocking by specialized security tools further corroborates its fraudulent nature. Users who interacted with nftlucky-box2.vercel.app should immediately revoke any wallet authorizations granted to the domain via their wallet interface. All connected accounts should be audited for unauthorized transactions, with particular attention to small test transfers that may precede larger thefts. If funds were transferred, victims should document transaction hashes and report them to relevant blockchain explorers and law enforcement. Wallet software should be updated to the latest version, and users are advised to monitor for follow-up phishing attempts via email or social media, as attackers often reuse stolen contact information for subsequent campaigns.