intuit-prev[.]vercel[.]app

This domain, intuit-prev.vercel.app, operates as a credential harvesting phishing site targeting users of Intuit financial software. The page replicates the legitimate Intuit Accounts sign-in interface, tricking victims into entering sensitive login credentials, which are then captured by threat actors. The site specifically impersonates the Intuit brand, increasing the likelihood of successful compromise for users of QuickBooks, TurboTax, or other Intuit services. Analysis indicates the domain exhibits multiple high-risk indicators. The domain was registered through Tucows Domains Inc. on February 21, 2026, an unusually future date suggesting potential falsification or manipulation of registration records. It resolves to IP address 216.198.79.3, hosted on Amazon.com, Inc. infrastructure (AS16509). Security vendors on VirusTotal flag the domain at a rate of 18/95, while it appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate, issued by Google Trust Services (WR1), provides a false sense of security to potential victims. Users who visited intuit-prev.vercel.app should immediately take corrective action. First, reset all credentials entered on the site, particularly Intuit account passwords and any reused passwords across other platforms. Enable multi-factor authentication on all financial and email accounts associated with the compromised credentials. Monitor account statements for unauthorized transactions and report suspicious activity to the respective financial institutions. If payment details were entered, consider placing a fraud alert or credit freeze with major credit bureaus. Users should also scan their devices for malware, as phishing sites may distribute additional payloads. Organizations should update endpoint protection rules to block this domain and its associated IP address.