easybank-landing-page-ecru-eta[.]vercel[.]app

This domain is flagged as a high-risk banking phishing resource targeting Easybank customers. Analysis indicates it mimics legitimate login portals to harvest credentials, a common tactic in financial fraud campaigns. The threat type is classified as a fake login page with credential theft intent, confirmed by its page title (Easybank landing page) and active status. Infrastructure analysis reveals the domain resolves to IP 216.198.79.67, hosted on Amazon.com, Inc. (AS16509) infrastructure in the US. It is registered through Vercel Inc. and currently appears on two security blocklists (PhishDestroy, PhishingDB). VirusTotal detection shows 20 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WR1), a detail often exploited by threat actors to lend false legitimacy to phishing pages. Mitigation steps for this threat include immediate blocking of the domain and its resolving IP at network perimeter devices. Security teams should prioritize monitoring for connections to 216.198.79.67 and implement real-time URL filtering to prevent access. End-user awareness should emphasize verifying domain authenticity before entering credentials, particularly for financial services. Incident responders should treat any interaction with this domain as a potential compromise and initiate credential reset procedures for affected accounts.