nft-luckybox17-eta[.]vercel[.]app

Analysis indicates the domain nft-luckybox17-eta.vercel.app was operational as a crypto drainer scam targeting NFT users. Registered on February 21, 2026, through Tucows Domains Inc., the domain resolved to IP 216.198.79.195 (AS16509, Amazon.com, Inc., US-based hosting). At the time of assessment, the domain returned an HTTP 451 status with the page title 'Deployment Unavailable,' suggesting it was either disabled or taken offline following detection. SSL certification was issued by Google Trust Services (WR1), and HSTS was enforced, which may have been leveraged to enhance perceived legitimacy.

The domain appeared on two security blocklists and was actively blocked by PhishDestroy and ScamSniffer. VirusTotal detections reached 16 of 93 security vendors, confirming malicious classification. Infrastructure analysis reveals the use of Vercel hosting, a common platform for rapid deployment of fraudulent schemes. The unique seed identifier for this campaign is 380b3c.

While the exact content and mechanics of the drainer are not yet fully analysed, the available indicators—including the domain name, scam type classification, and detection by specialized crypto-phishing tools—strongly suggest an intent to siphon cryptocurrency assets from victims. Defenders should treat this domain as compromised and ensure it is blocked at the network and endpoint levels. Further investigation into associated wallet addresses and transaction patterns is recommended to trace stolen funds and identify linked infrastructure.