redesigned-doodle-xi[.]vercel[.]app

This domain, redesigned-doodle-xi.vercel.app, is identified as a generic phishing infrastructure hosted on Vercel’s platform. Analysis indicates the site was designed to harvest user credentials or financial information, though no specific brand impersonation or cryptocurrency drainer kit signatures were detected in available telemetry. The page title, 'Deployment Unavailable,' suggests either a staging environment, a takedown placeholder, or an attempt to evade detection by presenting as a non-functional deployment. The absence of overt brand logos or payment gateways in captured snapshots does not preclude the possibility of dynamic content loading or conditional redirection to malicious endpoints once specific user-agent or geolocation criteria were met. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through Tucows Domains Inc., an atypical registrar for threat actors but not unprecedented in low-sophistication campaigns. It resolves to the IP address 216.198.79.131, geolocated to the United States under Amazon.com, Inc.’s AS16509, a common hosting provider for both legitimate and malicious content. The SSL certificate is issued by Google Trust Services (WR1), providing a veneer of legitimacy while not mitigating the underlying threat. At the time of assessment, 18 out of 95 security vendors on VirusTotal flagged the domain as malicious, a detection rate consistent with emerging or low-volume phishing campaigns. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is categorized as offline following takedown or suspension. Current status indicates the domain has been rendered inaccessible, likely due to platform enforcement or registrar intervention. However, the elevated risk level persists due to the domain’s recent creation date and the potential for infrastructure reuse. Historical DNS records and SSL certificate transparency logs should be monitored for re-emergence under altered subdomains or related apex domains. Organizations are advised to block the domain and IP at the perimeter, conduct retrospective log analysis for connections to 216.198.79.131, and alert users who may have interacted with the site prior to takedown. The use of Vercel’s hosting infrastructure underscores the trend of threat actors leveraging legitimate cloud services to evade detection and reduce operational costs.