luck-wonder5[.]vercel[.]app

Analysis of luck-wonder5.vercel.app, observed on July 23 2026, shows that the domain was registered on 21 February 2026 through Tucows Domains Inc. The site resolves to the IP address 64.29.17.131, which is announced by Amazon.com, Inc. (AS16509) and geographically located in the United States. The hosting platform is identified as Vercel and the service presents HTTP Strict Transport Security (HSTS). An HTTPS connection is established using a certificate issued by Google Trust Services (WR1), indicating a valid TLS chain. HTTP requests to the host return status code 451, and the site is currently reported as taken offline.

The page title returned by the server is “OpenSea.io”, which suggests an attempt to reference the well‑known NFT marketplace, but no further content has been captured. VirusTotal scans have recorded 16 positive detections out of 95 analyzed security vendors, confirming malicious classification. The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, reinforcing the phishing verdict. No additional public reputation sources such as Google Safe Browsing or OTX entries were observed in the available data.

Defenders should add the hostname and associated IP address to their inbound and outbound filtering rules, block any HTTP/HTTPS traffic to the domain, and flag the certificate issuer as a trusted source that may be abused by threat actors. Continuous monitoring of the IP range owned by AS16509 is advisable, as the infrastructure is shared with legitimate Amazon services. Since the site is already offline, remediation can focus on preventing future re‑use of the same domain or similar Vercel‑hosted subdomains. Organizations that have previously interacted with OpenSea should treat any login credentials or session tokens associated with this domain as compromised and enforce credential rotation.