luckiestmint2[.]vercel[.]app

This domain, luckiestmint2.vercel.app, is identified as an active crypto drainer phishing site designed to execute unauthorized transactions and siphon cryptocurrency assets from victims. The threat operates by tricking users into interacting with malicious smart contracts, typically through deceptive wallet connection prompts or fake token approvals. No legitimate brand association is observed, though the domain mimics common decentralized application naming conventions to appear credible. Infrastructure analysis reveals the use of a drainer kit, likely a variant of the prevalent 'Inferno Drainer' or 'Angel Drainer' families, given the observed behavioral patterns and technical indicators. Technical indicators confirm the domain's malicious nature. VirusTotal detection rates show 16 out of 95 security vendors flagging the domain as malicious. The domain was registered through Tucows Domains Inc. on February 21, 2026, with an anomalous future creation date suggesting potential registry manipulation or data obfuscation. It resolves to IP address 216.198.79.3, hosted on Amazon.com, Inc. (AS16509) infrastructure within the United States. Google Safe Browsing explicitly classifies the domain as phishing. The domain appears on three independent security blocklists, including PhishDestroy, ScamSniffer, and PhishingDB. SSL certificate analysis indicates the use of a Google Trust Services WR1 certificate, which does not mitigate the underlying threat. As of the latest verification, the domain remains active and operational, despite its 'Deployment Unavailable' page title, which may indicate a temporary placeholder or cloaking mechanism to evade detection. Immediate response actions include blocking the domain at the DNS and network levels, revoking any associated SSL certificates, and notifying the hosting provider for takedown. Users who interacted with the domain should revoke all active smart contract approvals, rotate private keys, and monitor wallet activity for unauthorized transactions. The remaining risk is classified as high due to the domain's persistence, the irreversible nature of cryptocurrency theft, and the potential for continued victim targeting through related infrastructure.