page-sbnim[.]vercel[.]app

This domain, page-sbnim.vercel.app, was observed pointing to the IP address 64.29.17.131, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Registration information shows the domain was created through Vercel Inc., a cloud‑hosting provider that also supplies the underlying infrastructure. The site presented an SSL certificate issued by Google Trust Services under the WR1 identifier, and the connection enforced HTTP Strict Transport Security. An HTTP request to the host returned status code 451, indicating the resource is unavailable for legal reasons, and the site is currently marked as offline.

The page title advertised “State Bank of India | PAN Update”, directly referencing the State Bank of India brand, and the scam type is listed as brand impersonation. VirusTotal analysis recorded 16 detections out of 95 scanning engines, confirming malicious classification by multiple vendors. The domain appears on a single security blocklist, PhishDestroy, and no public nameserver records were returned. The combination of a brand‑specific title, a valid TLS certificate, and a cloud‑based hosting profile is consistent with credential‑harvesting infrastructure.

At present, the exact content of the landing page cannot be verified because the service is offline, and no additional indicators such as form fields or tracking URLs are available. Defenders should proactively block the domain at DNS and proxy layers, add the IP address 64.29.17.131 to host‑based deny lists, and monitor for any future resolution changes. Continuous observation of Vercel‑hosted assets for similar brand‑impersonation patterns is recommended, as the provider’s shared infrastructure can host multiple abusive sites. The elevated risk rating reflects the targeted nature of the impersonation and the presence of multiple vendor detections.