bellebell[.]vercel[.]app

The domain bellebell.vercel.app has been identified as a credential phishing site targeting Bell Business customers. Analysis confirms this domain was actively impersonating official Bell Business infrastructure to harvest user credentials. As of the latest verification, the domain has been taken offline, though prior activity remains a documented threat. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 22, 2026, an anomalous creation date suggesting potential domain spoofing or backdating. The domain resolved to IP address 216.198.79.3, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. Security vendors flagged this domain with 23 detections out of 95 on VirusTotal, while it appeared on at least one security blocklist. The SSL certificate was issued by Google Trust Services under the WR1 intermediate, a common but not exclusive indicator of legitimate hosting environments. The page title, 'Bell Business Site,' directly mimics official Bell branding, reinforcing the phishing intent. Current status indicates the domain is offline, though residual risk persists due to potential credential exposure from prior interactions. Organizations and users are advised to monitor for unauthorized access attempts linked to credentials potentially harvested via this domain. Network defenders should update blocklists to include the domain and associated IP address, while conducting retrospective log analysis for connections to 216.198.79.3. Users who accessed the site should reset credentials for Bell Business or related accounts immediately. Given the elevated risk level, security teams should prioritize reviewing authentication logs for anomalies during the domain's active period.