jovielogin[.]vercel[.]app

Analysis of the domain jovielogin.vercel.app indicates a credential phishing operation targeting ID.me users, as identified by its page title 'Sign in to ID.me - ID.me' and explicit classification as a credential phishing scam. The domain was hosted on Vercel infrastructure, resolving to IP 216.198.79.195 within Amazon.com, Inc.'s AS16509 network in the United States. At the time of assessment, 16 of 95 security vendors on VirusTotal flagged the domain, and it appeared on at least one security blocklist, including PhishDestroy. Google Safe Browsing further classified the domain as engaging in social engineering activity. Technical indicators reveal the domain was registered through Vercel Inc. and utilized Vercel's nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com).

The SSL certificate was issued by Google Trust Services under the WR1 intermediate, a common configuration for Vercel-hosted applications. HTTP Strict Transport Security (HSTS) was enabled, which may complicate interception but does not mitigate the phishing intent. The domain returned an HTTP 451 status code, typically associated with content unavailable for legal reasons, though this may reflect takedown actions rather than voluntary removal. As of July 23, 2026, the domain is offline, limiting further analysis of its operational behavior or payload delivery mechanisms.

No evidence links this domain to previously documented phishing kits or actor infrastructure. Defenders should treat this domain as a confirmed phishing resource and prioritize blocking it at DNS, proxy, and endpoint levels. Security teams are advised to monitor for credential reuse attempts tied to this campaign, particularly within environments where ID.me authentication is employed. Additional scrutiny of Vercel-hosted subdomains with similar naming patterns (e.g., brand-related prefixes) may identify related threats.