openopenbox309[.]vercel[.]app

Analysis of openopenbox309.vercel.app indicates that the domain was provisioned through Vercel Inc. and resolves to the Amazon-owned IP address 64.29.17.195, which belongs to ASN 16509 (Amazon.com, Inc.) in the United States. The site presented the HTTP status code 451 and returned the page title “Deployment Unavailable,” suggesting the deployment has been taken offline, possibly after a takedown request. TLS termination is handled by Google Trust Services under the WR1 certificate, and the response includes HTTP Strict Transport Security (HSTS), confirming that the server enforces secure connections.

VirusTotal has recorded 14 detections out of 95 security vendors, reinforcing the malicious assessment. The domain is currently listed on four security blocklists and has been blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, indicating consensus among threat‑intelligence feeds that the domain was involved in a phishing operation. Nameserver lookup returned NS_NOT_FOUND, which may reflect a misconfiguration or a deliberate removal of DNS records after the takedown.

While the available data confirm the domain’s affiliation with phishing infrastructure, no direct samples of phishing pages, credential‑harvesting forms, or payloads have been recovered, leaving the exact content of the former deployment unknown. Defenders should continue to block the domain at perimeter and endpoint layers, monitor the underlying IP for any re‑hosting activity, and add the domain to internal watchlists. Ongoing scrutiny of DNS changes and periodic rescans with VirusTotal or similar services are recommended to detect any re‑emergence of malicious content.