openopenbox308[.]vercel[.]app

Analysis of the domain openopenbox308.vercel.app indicates it was actively flagged as a generic phishing threat prior to being taken offline. The domain, registered through Vercel Inc., resolved to IP address 216.198.79.195, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. At the time of assessment, the domain returned an HTTP 451 status code and displayed the page title 'Deployment Unavailable,' suggesting either a suspended or intentionally disabled deployment on Vercel's platform. No nameservers were detected, and the domain was absent from active DNS resolution, reinforcing its offline status.

The domain appeared on five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. Fifteen of 95 security vendors on VirusTotal flagged the domain as malicious, though the specific detection logic or phishing kit used remains unconfirmed. The SSL certificate was issued by Google Trust Services (WR1), a common issuer for legitimate and malicious domains alike, providing no definitive indication of intent. Detected technologies included Vercel's hosting framework and HTTP Strict Transport Security (HSTS), which are consistent with Vercel deployments but do not clarify the nature of the threat.

No brand impersonation was explicitly identified in the available data, and the exact content of the phishing page was not analyzed. Defenders should treat this domain as a confirmed malicious artifact, particularly if observed in logs or proxy data prior to July 24, 2026. Network-level blocking of the resolved IP (216.198.79.195) and monitoring for related subdomains under vercel.app are recommended. Given the domain's offline status and lack of DNS resolution, further forensic analysis may require historical WHOIS, passive DNS, or web archive data to reconstruct its operational timeline.