89uv-casefb489572[.]vercel[.]app

Analysis indicates that 89uv-casefb489572.vercel.app is a high-risk phishing domain targeting Facebook credentials, currently offline as of July 23, 2026. The domain was registered on February 21, 2026, through Tucows Domains Inc. and hosted on Vercel infrastructure, resolving to IP 216.198.79.131 (Amazon.com, Inc., AS16509, US). SSL certification is provided by Google Trust Services (WR1), and HTTP Strict Transport Security (HSTS) is enforced, which may have been leveraged to enhance perceived legitimacy. The domain is flagged by Google Safe Browsing for social engineering and appears on at least one security blocklist.

Sixteen of 93 security vendors on VirusTotal detect the domain as malicious, though the exact nature of the payload or phishing kit remains unconfirmed due to the site's current offline status (HTTP 451). The page title 'Deployment Unavailable' suggests the phishing infrastructure was either intentionally disabled or disrupted, though this does not rule out prior malicious activity. Infrastructure analysis reveals the use of Vercel, a legitimate hosting platform often abused for phishing due to its free tier and ease of deployment. The domain name structure ('casefb489572') includes a partial reference to Facebook, aligning with credential harvesting tactics.

No evidence confirms whether the site successfully collected credentials or distributed malware, but the combination of social engineering flags, blocklist presence, and detection by multiple security vendors supports a high-risk classification. Defenders should treat this domain as compromised infrastructure. Network-level blocks are recommended, and any prior exposure should trigger credential rotation for potentially affected accounts. Further investigation into the hosting account, SSL certificate reuse, and associated domains may uncover additional phishing campaigns leveraging the same infrastructure.