171tyesy[.]vercel[.]app

The domain 171tyesy.vercel.app is currently flagged as a generic_phishing site. It impersonates the Polish webmail service WP Poczta, potentially misleading users into divulging sensitive information. No specific drainer kit has been identified, but the site is designed to mimic a legitimate login page, increasing the risk of credential theft.

Infrastructure analysis reveals that 171tyesy.vercel.app resolves to the IP address 64.29.17.131 and is registered through Vercel Inc. The domain has an SSL certificate issued by Google Trust Services, which may provide a false sense of security. On VirusTotal, 14 out of 95 security vendors have flagged this domain, indicating a notable level of suspicion. The Google Safe Browsing (GSB) status of the domain is not provided, but the elevated detection count suggests potential malicious activity. The domain was created recently, which is a common indicator for phishing sites as they often have short lifespans to avoid detection.

The domain is currently active and poses an elevated risk. Immediate response actions include blocking the domain at the network level and alerting users to avoid interacting with it. Security teams should monitor for any changes in the domain's activity and consider further investigation to identify the full scope of the threat. Despite these actions, there remains a risk of ongoing or new phishing attempts, and users should remain vigilant and report any suspicious emails or login requests.