htyd[.]vercel[.]app

This domain, htyd.vercel.app, is currently flagged as an active credential harvesting phishing site. Analysis indicates the page impersonates a legitimate login portal, specifically designed to harvest user credentials under the guise of a trusted authentication process. The threat type is classified as high-risk due to its direct targeting of sensitive user data, including usernames, passwords, and potentially multi-factor authentication details. No specific brand impersonation has been conclusively identified, but the generic login interface suggests broad targeting of common service providers. Infrastructure analysis reveals the domain is hosted on Vercel’s platform and resolves to the IP address 216.198.79.3. The SSL certificate is issued by Google Trust Services under the WR1 intermediate, a common configuration for legitimate services, which may aid in evading initial suspicion. The domain appears on one security blocklist and has been flagged by 22 of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its malicious nature. The page title, 'Sign in to your account,' further supports the credential harvesting objective, as it mirrors standard login prompts used by legitimate platforms. Current status confirms the domain remains active and operational, posing an ongoing threat to unsuspecting users. Organizations and individuals are advised to block access to this domain at the network level, including its resolving IP address. Endpoint protection solutions should be updated to include this domain in their threat intelligence feeds. Users who may have interacted with the site should immediately reset credentials for any accounts accessed during the suspected exposure window. Security teams are encouraged to monitor for indicators of compromise, particularly unauthorized access attempts or anomalous authentication logs originating from the identified IP address.