recover-snapchat[.]vercel[.]app

recover-snapchat.vercel.app was observed serving a page titled “Log In • Snapchat”. The site was hosted on Vercel infrastructure and employed HTTP Strict Transport Security, indicating an attempt to appear legitimate. The server responded with HTTP 451, a status often used for legal takedown or unavailable content, and the SSL certificate was issued by Google Trust Services under the WR1 identifier, further reinforcing a veneer of authenticity. Network analysis shows the domain resolved to IP 64.29.17.67, which is part of Amazon’s AS16509 network located in the United States.

The domain was registered through Vercel Inc., a common registrar for short‑lived phishing deployments. VirusTotal scans recorded 16 detections out of 95 security vendors, confirming malicious classification, and the domain appears on at least one external blocklist. PhishDestroy has also taken the site offline, and the current status is listed as “taken offline”. The threat vector aligns with a social media phishing campaign targeting Snapchat users, as indicated by the brand impersonation label and the page title.

Uncertainty remains regarding the full scope of the campaign, the presence of any additional payloads, and whether the domain was used to harvest credentials before takedown. Defenders should add recover-snapchat.vercel.app to URL filtering and DNS blocklists, monitor the hosting provider’s Vercel subdomains for similar naming patterns, and consider blocking the associated IP range (64.29.17.67) on perimeter firewalls. Continuous monitoring of VirusTotal and other threat intel feeds for new detections involving Vercel‑hosted Snapchat impersonation sites is recommended to capture any resurgence of the campaign.