ttkpay-front-funil-cmr[.]vercel[.]app

This domain, ttkpay-front-funil-cmr.vercel.app, operates as a phishing site designed to deceive users into participating in a fraudulent survey promising financial rewards up to R$850. The site presents itself as a legitimate promotional campaign, leveraging social engineering tactics to harvest personal and financial information from victims. Analysis of the page title, 'Campanha Bonus – Responda nossa pesquisa e ganhe até R$ 850 em premiações,' indicates a clear intent to exploit users' trust in reward-based schemes, particularly targeting Portuguese-speaking audiences. Infrastructure analysis reveals that the domain is hosted on Vercel Inc.'s platform and resolves to the IP address 64.29.17.67, associated with Amazon.com, Inc. (AS16509). The site's SSL certificate is issued by Google Trust Services, a common practice among phishing domains to appear legitimate. Detection metrics further confirm its malicious nature, with 17 out of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, reinforcing its classification as a phishing threat. Users who visited this domain should take immediate action to mitigate potential risks. First, refrain from entering any personal or financial information on the site. If credentials or payment details were submitted, affected individuals should change passwords for all critical accounts, enable multi-factor authentication where available, and monitor financial statements for unauthorized transactions. Reporting the domain to local cybersecurity authorities or consumer protection agencies can also help prevent further victimization. Regularly updating security software and verifying the legitimacy of reward-based promotions through official channels are recommended preventive measures.