dgfctxrhx324345464[.]vercel[.]app

This domain is actively impersonating Banco Pichincha, a financial institution, to harvest user credentials through a fraudulent login interface. Visitors to dgfctxrhx324345464.vercel.app are presented with a cloned version of the bank’s legitimate website, designed to deceive users into entering sensitive account details, including usernames, passwords, and potentially two-factor authentication codes. The threat primarily targets customers of Banco Pichincha, though the infrastructure could be repurposed for broader financial fraud campaigns. Analysis indicates this phishing domain is hosted on Vercel’s platform, with an SSL certificate issued by Google Trust Services (WR1). The domain resolves to the IP address 216.198.79.3, geolocated to a hosting provider in the United States. As of the latest verification, the page remains operational and has been flagged by 19 out of 95 security vendors on VirusTotal, including detection by Google Safe Browsing and one additional security blocklist. The page title explicitly mimics Banco Pichincha’s branding, reinforcing its deceptive intent. No legitimate association with the bank or its official infrastructure has been identified. Individuals who have visited this domain or entered credentials should immediately take corrective action. First, change passwords for Banco Pichincha and any other accounts where the same credentials may have been reused. Enable multi-factor authentication if not already active. Monitor bank statements and account activity for unauthorized transactions, and report any suspicious activity to the financial institution. If personal or financial data was submitted, consider contacting local cybersecurity authorities or consumer protection agencies to document the incident. Avoid interacting with the domain further, and ensure endpoint security tools are updated to block access to confirmed malicious infrastructure.