ncrm-casefb588197[.]vercel[.]app

This domain ncrm-casefb588197.vercel.app is currently offline, returning HTTP 451 with page title “Deployment Unavailable”. The domain was registered on February 21, 2026 through Tucows Domains Inc. and is hosted on the Vercel platform, which enforces HSTS. DNS resolution points to IP address 216.198.79.3, an Amazon-owned address (AS16509) located in the United States. The TLS certificate presented is issued by Google Trust Services under the WR1 profile, indicating a valid certificate chain but providing no guarantee of legitimacy.

Google Safe Browsing classifies the site as a social‑engineering threat, and it is listed on a single security blocklist that includes PhishDestroy as a blocker. VirusTotal analysis shows that 14 of 95 security vendors have flagged the domain, reinforcing the malicious reputation. The combination of a recent creation date, a cloud‑based hosting provider, and multiple detection sources suggests a purpose‑built phishing infrastructure, although the exact target or payload has not been observed because the site is taken offline.

Defenders should continue to block the domain at perimeter devices, monitor DNS queries for the IP 216.198.79.3, and consider adding the address to internal blocklists. Additional scrutiny of any outbound traffic to Vercel endpoints from internal users is advisable, and incident response teams should treat any credentials submitted to this URL as potentially compromised. Ongoing intelligence collection is recommended to determine whether the domain reappears or is used in a broader campaign.