listed-livegrabs40[.]vercel[.]app

Analysis of listed-livegrabs40.vercel.app indicates that the domain was registered on 21 February 2026 through Tucows Domains Inc. and resolves to the Amazon Web Services address 64.29.17.67, which belongs to ASN 16509 (Amazon.com, Inc.) located in the United States. The site presented an HTTP 451 response with the page title “Deployment Unavailable” and served a TLS certificate issued by Google Trust Services (CN WR1). Fingerprinting identified the Vercel hosting platform and the presence of HTTP Strict Transport Security (HSTS). VirusTotal recorded 15 detections out of 93 scanned scanners, and the domain is currently listed on four external blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura.

The domain’s risk rating is high, and its status is offline at the time of this report. Evidence confirms that the infrastructure is typical of fast‑deployment phishing campaigns that leverage cloud providers to obtain short‑lived URLs. However, the content of the site has not been captured beyond the generic “Deployment Unavailable” title, so the exact lure, credential‑harvesting form, or targeted brand cannot be verified. The lack of a live page limits forensic detail, but the combination of recent registration, AWS hosting, TLS from a reputable CA, and multiple vendor detections strongly suggests a deliberate malicious operation.

Defenders should proactively block the IP address 64.29.17.67 and the domain name in perimeter security controls. Monitoring for new subdomains under the same registrar or ASN is advisable, as threat actors frequently recycle similar infrastructure. Adding the domain to internal URL filtering lists and sharing the indicator set with threat‑intel platforms will help prevent accidental user exposure. Continuous re‑scanning of the domain is recommended in case the site becomes active again, allowing updated detection signatures to be applied.