listed-livegrabs51[.]vercel[.]app

This domain, listed-livegrabs51.vercel.app, is an active phishing site designed to harvest user credentials through fraudulent login interfaces. Analysis indicates the site mimics legitimate authentication portals, likely targeting users of cryptocurrency platforms or financial services, given its presence on specialized blocklists. The domain employs social engineering tactics to trick victims into submitting sensitive information, including usernames, passwords, and multi-factor authentication codes, which are then exfiltrated to attacker-controlled infrastructure. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 21, 2026, through Tucows Domains Inc., and resolves to IP address 216.198.79.131, hosted on Amazon Web Services (AS16509). Security vendors have flagged the domain in 17 out of 95 VirusTotal engines, while it appears on five distinct security blocklists. The SSL certificate, issued by Google Trust Services (WR1), provides a false sense of security while facilitating encrypted exfiltration of stolen credentials. The page title 'Deployment Unavailable' suggests either a placeholder or an attempt to evade detection by mimicking a legitimate service outage. Users who have visited listed-livegrabs51.vercel.app or entered credentials on the site should take immediate remediation steps. All exposed passwords must be changed across any accounts where the same credentials were reused. Multi-factor authentication should be enabled or reset if already in use. System scans using updated security tools are recommended to detect potential secondary infections or data exfiltration. Network logs should be reviewed for connections to 216.198.79.131 or related domains. Organizations should add this domain and IP to internal blocklists and monitor for credential stuffing attempts using harvested data. Given the high-risk classification and active status, all interactions with this domain should be treated as compromised.