sonerviac[.]vercel[.]app

Analysis of sonerviac.vercel.app indicates that the domain was registered through Tucows Domains Inc. on February 21, 2026 and subsequently pointed to the Vercel hosting platform, as evidenced by the presence of Vercel technology and an HSTS header. The site currently returns HTTP status code 451 and presents the page title “Deployment Unavailable”, suggesting that the deployment has been taken offline. DNS resolution points to IP address 216.198.79.195, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The TLS certificate for the domain is issued by Google Trust Services under the WR1 certificate profile, confirming that the connection is encrypted but does not imply legitimacy.

VirusTotal has recorded 15 detections out of 95 scanned security vendors, indicating a moderate level of malicious labeling across multiple engines. Google Safe Browsing classifies the domain as a social engineering threat, and the domain appears on at least one public blocklist, where it has also been flagged by the PhishDestroy service. The combination of a recent creation date, a Vercel‑based deployment that has been deliberately removed, and the presence of multiple vendor detections aligns with a high‑risk generic phishing classification. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms that may have been hosted before the deployment was withdrawn, as no content beyond the “Deployment Unavailable” title has been observed.

Defenders should continue to block the domain at network perimeter devices, update DNS filtering rules to include the associated IP address, and monitor for any re‑activation of the Vercel deployment. Ongoing surveillance of the IP range and periodic rescans with VirusTotal or similar services are recommended to capture any changes in detection status.