lucky-giftbox2[.]vercel[.]app

This domain, lucky-giftbox2.vercel.app, is flagged as a high-risk phishing site specializing in crypto credential harvesting. Analysis indicates the infrastructure was designed to mimic legitimate cryptocurrency reward portals, likely targeting users of decentralized finance platforms. No specific brand impersonation or drainer kit signatures were identified, but the domain's naming convention and hosting pattern align with known credential theft campaigns observed in Q1 2026. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 64.29.17.195, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. It was registered through Tucows Domains Inc. on February 21, 2026, with an SSL certificate issued by Google Trust Services (WR1). VirusTotal detection ratio stands at 12/95 security vendors, and the domain appears on four independent security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Google Safe Browsing status was not explicitly provided, but the blocklist presence suggests active malicious classification. The domain is currently offline, with a 'Deployment Unavailable' page title indicating either takedown or voluntary deactivation by the threat actor. While the immediate threat has been mitigated, residual risk remains for users who may have interacted with the site prior to its removal. Network defenders should add the domain and associated IP to blocklists, monitor for credential reuse attempts, and conduct retrospective analysis on logs for connections to 64.29.17.195 between February 21 and the takedown date. End users should revoke any wallet permissions or session tokens potentially exposed during the active window.