ttoolblox[.]vercel[.]app

On 2 August 2026 the domain ttoolblox.vercel.app was observed operating as a generic phishing site. The infrastructure analysis shows the domain is hosted on the Vercel platform, with the DNS resolving to the IPv4 address 64.29.17.67. Vercel is listed as the registrar, indicating that the domain was provisioned through the cloud service’s automated registration process. VirusTotal has recorded a single positive detection among 91 scanned security vendors, reflecting that at least one vendor flagged the domain as malicious.

The domain is currently listed on one public security blocklist and is actively blocked by the PhishDestroy mitigation service. The threat is classified with an elevated risk level and remains active as of the report date. No additional public intelligence such as page title, SSL certificate details, or observed content has been published, leaving the exact phishing payload and targeted brand undefined. Consequently, defenders should continue to monitor the domain for any changes in detection counts, blocklist status, or hosting attributes.

Immediate mitigation actions include adding the IP address 64.29.17.67 and the fully qualified domain name to network‑level deny lists, updating web‑proxy and DNS filtering rules, and ensuring that endpoint protection solutions incorporate the latest VirusTotal signatures. Continuous observation of Vercel‑hosted domains is recommended, as the platform’s rapid provisioning can be abused for short‑lived malicious campaigns. Until further content analysis is available, the domain should be treated as a high‑confidence phishing indicator.