infinite-wonderbox20[.]vercel[.]app

Analysis of infinite-wonderbox20.vercel.app shows a recently registered domain created on February 21, 2026 and registered through Tucows Domains Inc. The domain resolves to the IP address 64.29.17.131, which is part of Amazon.com, Inc. (AS16509) and is geolocated in the United States. Infrastructure observations indicate the site is hosted on the Vercel platform and enforces HTTP Strict Transport Security (HSTS). The TLS certificate is issued by Google Trust Services under the WR1 certificate authority, confirming a valid HTTPS endpoint despite the site being unavailable.

An HTTP request to the domain returns status code 451, accompanied by the page title "Deployment Unavailable," suggesting that the underlying Vercel deployment has been deliberately taken down or blocked for legal reasons. Threat intelligence from VirusTotal reports that ten of ninety‑five scanning engines have flagged the domain, reflecting a moderate consensus of malicious behavior. The domain is currently listed on one public security blocklist and has been blocked by the PhishDestroy service, reinforcing the suspicion of phishing activity.

The combination of recent registration, Amazon‑hosted infrastructure, Vercel hosting, a valid Google‑issued certificate, and multiple vendor detections aligns with patterns observed in generic phishing campaigns that exploit trusted hosting services to lend credibility to fraudulent URLs. Defenders should continue to monitor the domain for any re‑activation, add the host to internal deny lists, and instruct users to avoid any unsolicited communications referencing the domain. Given the offline status, immediate remediation is limited to blocking any future resolution attempts and ensuring that endpoint security solutions are updated with the latest indicator data.