luckiestmint18[.]vercel[.]app

Analysis of luckiestmint18.vercel.app shows a high‑risk crypto drainer infrastructure that has been taken offline as of the report date (July 24, 2026). The domain was registered on February 21, 2026 through Tucows Domains Inc. and resolves to the Amazon Web Services address 64.29.17.131, located in the United States under ASN 16509 (Amazon.com, Inc.). The site presents an HTTPS certificate issued by Google Trust Services / WR1, indicating a valid TLS chain, and Vercel hosting is identified through HTTP headers together with enforced HTTP Strict Transport Security. When queried, the server returns HTTP status 451 and a page title of “Deployment Unavailable”, suggesting the application has been deliberately removed or disabled. Reputation services corroborate malicious intent.

Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on two dedicated blocklists—PhishDestroy and ScamSniffer. VirusTotal analysis recorded 15 detections out of 93 scanning engines, reinforcing the classification as a crypto‑related scam. The listed scam type is “Crypto Scam”, consistent with a crypto drainer profile that typically attempts to exfiltrate cryptocurrency assets from unsuspecting victims. Despite the offline status, the observed indicators remain useful for defensive tooling.

Security teams should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any future activation, and incorporate the SSL fingerprint and HTTP‑451 response into threat‑intel feeds. The presence of Vercel and HSTS suggests that any future redeployment could reuse the same infrastructure, so automated detection rules that flag similar TLS configurations combined with the known blocklist entries are recommended. At present, no additional payload or page content has been captured, leaving the exact phishing vector undetermined.