espressopiloto[.]vercel[.]app

Analysis indicates that espressopiloto.vercel.app is associated with a high-risk brand impersonation threat targeting scroll. The site is currently active and presents itself with the page title "ESPRESSO PILOTO". Infrastructure characteristics and threat intelligence data suggest potential use in credential harvesting, deceptive user interaction, or other forms of impersonation intended to exploit trust associated with the targeted brand. The domain should be treated as untrusted until its legitimacy can be independently verified.

Evidence collected from multiple intelligence sources shows that the domain remains active and resolves to IP address 216.198.79.195 located in the US under AS16509 Amazon.com, Inc. The domain was created on January 28, 2020 and is registered through Vercel Inc. The SSL certificate is issued by Google Trust Services / WR1. Threat intelligence records indicate appearance on 3 security blocklists, and the domain is blocked by PhishDestroy, MetaMask, and SEAL. Detection data shows that VirusTotal reports 2/95 security vendors flagging the domain. While the detection ratio is not universally high, the combination of active brand impersonation indicators, existing blocklist presence, and continued availability increases overall risk exposure.

Users who interacted with espressopiloto.vercel.app should consider any submitted information potentially exposed. Recommended actions include changing credentials associated with any accounts used during the visit, reviewing account activity for unauthorized access, enabling multi-factor authentication where available, and monitoring for suspicious communications or transaction requests. Security teams should record the domain, page title, IP address, and associated indicators for detection and response purposes. Access to the domain should be restricted pending further investigation, and any related authentication tokens or session data should be considered for revocation as a precautionary measure.