linkd-one[.]vercel[.]app

This investigation documents the infrastructure associated with linkd-one.vercel.app, a domain observed as a high‑risk generic phishing site and taken offline as of July 24, 2026. The domain was registered on February 21, 2026 through Tucows Domains Inc., indicating a relatively recent creation date. DNS resolution points to the address 216.198.79.67, an Amazon.com, Inc. host (AS16509) located in the United States. The server presents an SSL certificate issued by Google Trust Services under the WR1 name, confirming the use of a valid HTTPS endpoint despite the site’s malicious purpose. HTTP probing returned a 404 status code, suggesting that the expected content is no longer reachable, which aligns with the reported offline status.

Security‑vendor analysis recorded 14 detections out of 93 scanners on VirusTotal, and Google Safe Browsing classified the URL as social engineering, reinforcing the phishing assessment. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service. Technological fingerprints identify Vercel hosting and the presence of HTTP Strict Transport Security (HSTS), which may have been employed to improve the perceived legitimacy of the site.

The only visible page element captured prior to takedown was the title "Welcome back," but no further content details have been disclosed. Consequently, the specific lures, credential‑stealing mechanisms, or targeted brands remain unknown. Defenders should continue to monitor the IP address 216.198.79.67 for any re‑use, enforce outbound filtering for the domain, and ensure that URL reputation services are updated to reflect the current blocklist status. Incident response teams are advised to correlate any login attempts or credential submissions with this indicator, and threat‑intel platforms should ingest the domain’s creation and detection timestamps to improve attribution of similar Vercel‑based phishing campaigns.