sucursalvnbancol[.]vercel[.]app

This domain, sucursalvnbancol.vercel.app, operates as a credential harvesting phishing site targeting users of a Latin American financial institution. Analysis indicates the site employs social engineering tactics to deceive visitors into entering sensitive authentication details, including usernames, passwords, and multi-factor authentication codes. The domain mimics legitimate banking portals, leveraging visual and structural similarities to lower user vigilance during interaction. Google Safe Browsing has explicitly flagged the domain under the SOCIAL_ENGINEERING category, confirming its intent to manipulate users into disclosing confidential information. Infrastructure analysis reveals the domain is hosted on Vercel Inc. infrastructure and resolves to the IP address 216.198.79.195. The SSL certificate is issued by Google Trust Services, providing a false sense of security to end users. As of the latest scan, 14 out of 95 security vendors on VirusTotal have detected the domain as malicious, with detections spanning phishing, fraud, and social engineering classifications. The domain remains active, with no evidence of takedown or mitigation efforts. No historical registration data is publicly available, limiting attribution analysis, but the use of a cloud-based hosting provider suggests an attempt to evade traditional blocklisting mechanisms. Users who have visited sucursalvnbancol.vercel.app or entered credentials on the site should immediately revoke any active sessions on their financial accounts and reset all associated passwords. Multi-factor authentication tokens tied to the compromised credentials must be invalidated and reissued. Financial institutions should be notified of the potential breach to monitor for unauthorized transactions. Network administrators are advised to block the domain and its resolving IP (216.198.79.195) at the perimeter, and endpoint protection solutions should be updated to include this indicator of compromise. If browser-based access occurred, users should clear cached data and run a full system scan to detect any secondary payloads or persistent threats.