easybanktheface[.]vercel[.]app

This domain, easybanktheface.vercel.app, is classified as a high-risk credential theft phishing campaign designed to harvest banking login credentials by impersonating the legitimate Easybank brand. Analysis indicates the threat actor has constructed a fraudulent landing page titled 'The Face | Easybank landing page,' which closely mimics the authentic Easybank interface to deceive victims into submitting sensitive authentication details. The campaign remains active and poses a significant risk to users who may unknowingly disclose their credentials, leading to unauthorized account access and financial fraud. Infrastructure analysis reveals the domain is hosted on Vercel Inc.’s platform and resolves to the IP address 198.18.1.200, geolocated within the United States under Amazon.com, Inc.’s AS16509. The SSL certificate is issued by Google Trust Services (WR1), a common tactic to lend an appearance of legitimacy. Detection metrics indicate the domain is flagged by 17 out of 95 security vendors on VirusTotal, while two independent blocklists—PhishDestroy and PhishingDB—have already classified it as malicious. Despite these indicators, the domain remains operational, suggesting either delayed takedown efforts or deliberate evasion techniques employed by the threat actor. Mitigation against this credential theft campaign requires immediate action from both end-users and security teams. Users should verify the authenticity of banking portals by cross-referencing URLs with official domains and enabling multi-factor authentication to mitigate the impact of stolen credentials. Security teams are advised to block the domain and its resolving IP (198.18.1.200) at the network perimeter, while also monitoring for signs of credential reuse across internal systems. Financial institutions should proactively alert customers to this campaign and reinforce phishing awareness training to reduce susceptibility to such impersonation attacks.