zcxwmnbv[.]vercel[.]app

The domain zcxwmnbv.vercel.app is currently listed as active and classified as a high‑risk generic phishing site. It appears on a single security blocklist, specifically PhishDestroy, which has taken the domain offline in its own filtering system. Google Safe Browsing has also flagged the domain for social engineering, indicating that the URL is being used to lure users into disclosing credentials or personal data. VirusTotal analysis shows that 21 out of 91 scanned security vendors have reported the domain as malicious, reinforcing the suspicion of malicious intent. The presence of multiple independent detections suggests a coordinated campaign rather than an isolated false positive.

The domain is hosted on the vercel.app sub‑domain namespace, a common platform for legitimate web applications, which can obscure the true infrastructure behind a trusted CDN. No additional contextual data such as page title, SSL certificate details, or HTTP response codes are available in the current intelligence set, leaving the exact payload and landing‑page behavior undefined. Consequently, analysts cannot confirm the specific phishing lures employed, nor can they attribute the activity to a particular threat actor group.

Given the corroborated detections across blocklists, Safe Browsing, and VirusTotal, defenders should treat any traffic to zcxwmnbv.vercel.app as malicious. Recommendations include adding the domain to internal blocklists, configuring web proxies to deny outbound connections, and monitoring DNS logs for queries to the domain. Incident response teams should also capture any network artifacts associated with the domain for deeper forensic analysis, as further investigation may reveal the underlying phishing kit, credential‑harvesting forms, or additional command‑and‑control infrastructure. Continuous re‑evaluation is advised, as future scans may provide richer metadata that could refine detection signatures and response playbooks.