nftlucky-box16[.]vercel[.]app

The domain nftlucky-box16.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. and is hosted on a Vercel infrastructure identified by the IP address 216.198.79.3, which maps to the Amazon.com, Inc. ASN16509 network located in the United States. The site presents the page title "Deployment Unavailable" and returns an HTTP 451 status code, indicating that the content has been removed or is otherwise inaccessible. TLS termination is provided by a Google Trust Services certificate issued under the WR1 profile, and the site enforces HSTS, confirming the use of modern transport security practices. Threat intelligence classifies the domain as an NFT‑related crypto drainer, a subset of cryptocurrency scams that typically attempt to lure victims into transferring tokens or granting wallet permissions.

This classification is reinforced by its inclusion on four security blocklists and explicit blocking by PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal analysis shows that 15 of 93 scanning engines flagged the domain, further supporting malicious intent. While the site is currently offline, the presence of a Vercel deployment and the use of a reputable SSL certificate suggest that the operators leveraged legitimate cloud services to mask malicious activity, a common tactic for evading simple reputation checks. The exact phishing payload, wallet address, or social engineering vector has not been publicly disclosed, leaving the precise method of token exfiltration uncertain.

Defenders should proactively block DNS resolution for nftlucky-box16.vercel.app and add the associated IP 216.198.79.3 to network deny lists. Existing intrusion detection signatures that monitor for Vercel‑hosted malicious domains should be updated to include this indicator. Security teams should also monitor for any future re‑registration or similar domain patterns that reuse the "nftlucky" string, as threat actors often iterate on successful naming conventions.