dervy[.]vercel[.]app

This domain, dervy.vercel.app, poses a high-risk brand impersonation threat by mimicking Google to deceive users into disclosing sensitive credentials or personal information. The site is designed to appear legitimate, potentially tricking visitors into entering login details, financial data, or other confidential information under false pretenses. Analysis indicates this is part of a broader campaign to harvest user data for malicious purposes, including account takeovers or identity theft. Infrastructure analysis reveals the domain is currently active and resolves to the IP address 216.198.79.131, hosted by Vercel Inc. in the United States. The SSL certificate is issued by Google Trust Services, adding a layer of perceived legitimacy. Security vendors have flagged the domain as malicious, with 20 out of 95 engines on VirusTotal detecting it as a threat. The page title, 'Banco Pichincha,' suggests an attempt to impersonate a financial institution, though the primary target remains Google. The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. If you or someone in your organization visited dervy.vercel.app, immediate action is required. Disconnect the affected device from the network to prevent potential data exfiltration. Reset credentials for any accounts accessed while the site was open, prioritizing email, financial, and work-related logins. Enable multi-factor authentication where available to add an extra layer of security. Monitor accounts for unauthorized activity and report any suspicious transactions or communications. Consider scanning the device for malware using updated security tools to ensure no additional threats were introduced.