lucky-giftbox17[.]vercel[.]app

This domain, lucky-giftbox17.vercel.app, operates as a crypto drainer scam designed to compromise digital wallet credentials and siphon cryptocurrency. Analysis indicates the site presents itself as a promotional giveaway or reward platform, a common tactic to lure victims into connecting their wallets. Once connected, malicious scripts execute unauthorized transactions, transferring assets to attacker-controlled addresses without user consent. The threat primarily targets users of decentralized finance (DeFi) platforms, non-fungible token (NFT) marketplaces, and cryptocurrency holders who may be enticed by fake incentives. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain is flagged by 18 out of 95 security vendors on VirusTotal, with detections spanning phishing, fraud, and malicious script categories. It was registered on February 21, 2026, through Tucows Domains Inc., an unusually recent creation date for a domain hosting malicious activity. The site resolves to IP address 64.29.17.195, hosted on Amazon Web Services (AS16509), and appears on five security blocklists, including PhishDestroy and PhishingDB. The SSL certificate, issued by Google Trust Services (WR1), provides no legitimacy, as malicious actors frequently abuse free or automated certificate issuance to appear trustworthy. If you visited lucky-giftbox17.vercel.app or interacted with its content, immediate action is required. Disconnect any connected wallets from the site and revoke all associated smart contract approvals using a blockchain explorer or wallet management tool. Scan the device used for access with updated antivirus software to detect potential malware or keyloggers. Monitor all linked accounts, including email and cryptocurrency wallets, for unauthorized transactions. If funds were transferred, report the incident to relevant blockchain analytics platforms and local cybercrime authorities, providing transaction hashes and timestamps. Replace any compromised credentials, enable multi-factor authentication where available, and avoid reusing passwords across platforms. Users should verify future domains through independent threat intelligence sources before interaction.