d360-one[.]vercel[.]app

Analysis of d360-one.vercel.app indicates a generic phishing infrastructure hosted on a cloud deployment platform, leveraging dynamically generated subdomain hosting to deliver deceptive web content. The absence of legitimate service branding combined with a “Deployment Unavailable” page title suggests either misconfigured payload staging or cloaked phishing deployment attempts. No explicit drainer kit branding is detected, but behavioral patterns align with fake login credential harvesting campaigns.

Technical indicators confirm a VirusTotal detection ratio of 16/95 security vendors marking the domain as malicious. The domain is registered through Tucows Domains Inc. It resolves to IP 64.29.17.131, geolocated in the United States under AS16509 Amazon.com, Inc. SSL certificate is issued by Google Trust Services (WR1). Domain creation date is February 21, 2026. Google Safe Browsing classifies the domain as phishing. The domain appears on 2 independent security blocklists.

The domain remains active, indicating ongoing exposure and potential live phishing deployment risk. Given the combination of cloud-hosted infrastructure, validated phishing classification, and moderate detection coverage, the threat is assessed as high risk. Immediate defensive actions include domain-level blocking, DNS sinkholing, and user awareness enforcement. Continuous monitoring is recommended due to potential redeployment under alternate subdomains or rapidly rotated infrastructure.