infinite-wonderbox12[.]vercel[.]app

The domain infinite-wonderbox12.vercel.app was registered on 21 February 2026 through Tucows Domains Inc. and is hosted on the Vercel platform, as indicated by the detected technology stack and the presence of an HSTS header. DNS resolution points to IP 216.198.79.195, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site currently returns HTTP 451 “Unavailable For Legal Reasons” and the page title is “Deployment Unavailable”, suggesting that the underlying application has been taken offline, either by the operator or by an enforcement action. VirusTotal has recorded 15 positive detections out of 93 submitted scanners, confirming that multiple security vendors have identified malicious characteristics associated with this hostname.

The SSL certificate is issued by Google Trust Services under the “WR1” designation, which is typical for Vercel‑hosted sites and does not, by itself, indicate legitimacy. The domain appears on two public phishing blocklists, PhishDestroy and ScamSniffer, reinforcing the assessment that it was used for phishing‑type activity before being disabled. At present, no further content is observable, and the limited public evidence leaves the specific phishing vector (e.g., credential harvesting page, impersonated brand) unknown.

Defenders should continue to block the domain and associated IP address at network perimeters, update URL filtering policies, and monitor for any re‑hosted copies that might emerge on alternative infrastructure. Incident response teams encountering emails or messages that reference this URL should treat them as malicious and advise users to delete the communication. Ongoing threat‑intel collection should focus on any new DNS records, TLS certificate changes, or resurgence of the domain on additional blocklists.