rtalbebfkargfvdh[.]vercel[.]app

This domain, rtalbebfkargfvdh.vercel.app, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive authentication details. Analysis indicates the threat type is generic phishing with a focus on impersonating legitimate login portals to capture usernames, passwords, and session tokens. As of the latest verification, the domain has been taken offline, though prior activity remains a documented risk. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence platforms. It was registered through Vercel Inc. and resolved to the IP address 198.18.1.189, hosted under Amazon.com, Inc. (AS16509) in the United States. The SSL certificate, issued by Google Trust Services (WR1), provided a false sense of security to potential victims. The domain appeared on two security blocklists, including PhishDestroy and PhishingDB, further corroborating its malicious intent. The page title, Deployment Unavailable, suggests an attempt to mask its true purpose or a failed deployment state. Current status confirms the domain is offline, reducing immediate risk to end users. However, the infrastructure and tactics observed align with persistent phishing campaigns leveraging cloud-based hosting services. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Endpoint protection systems should be updated to include this domain in their threat signatures. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Monitoring for unusual login attempts or unauthorized access is recommended as a precautionary measure.