pbh8-casefb773880[.]vercel[.]app

This domain pbh8-casefb773880.vercel.app was observed delivering a generic phishing payload and is currently offline. The site responded with HTTP status 451, indicating a legal restriction, and its page title was reported as “Deployment Unavailable”. DNS resolution points to IP address 64.29.17.67, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in the United States. The domain was registered on 21 February 2026 through Tucows Domains Inc., a registrar commonly used for short‑lived malicious sites.

Infrastructure analysis shows the presence of Vercel hosting and HTTP Strict Transport Security (HSTS) enforcement, and the TLS certificate is issued by Google Trust Services under the WR1 designation, confirming a valid certificate chain. VirusTotal scans recorded 14 detections out of 93 security vendors, indicating that multiple AV engines flagged the domain as malicious. The domain is listed on at least one external blocklist and is actively blocked by the PhishDestroy service. No additional intelligence such as target brand, payload samples, or compromised credentials has been published.

Because the site is already taken offline, immediate containment is not required, but defenders should ensure that any recent traffic to the IP address 64.29.17.67 is logged and that internal DNS caches are purged. Monitoring for re‑registration of the same sub‑domain pattern on Vercel or similar cloud platforms is recommended, as threat actors frequently recycle naming schemes. Organizations should also maintain up‑to‑date phishing detection rules that incorporate the observed HTTP 451 response and the “Deployment Unavailable” title, and consider adding the domain to local blocklists to prevent accidental resolution in the future.