united-airlines-inky[.]vercel[.]app

This domain, united-airlines-inky.vercel.app, operates as an active credential harvesting phishing site targeting users of a corporate travel and benefits portal. The page presents an imitation login interface for United Airlines under the title 'Log On | United Airlines | Alight WorkLife,' designed to deceive employees or travelers into submitting corporate or personal credentials. The site employs visual spoofing techniques, including replicated branding elements and a seemingly legitimate URL structure, to enhance its credibility and bypass casual user scrutiny. Analysis indicates the site is part of a broader campaign leveraging cloud hosting services to rapidly deploy and rotate phishing infrastructure with minimal detection latency. Infrastructure analysis reveals the domain is registered through Vercel Inc. and resolves to the IP address 216.198.79.67, located within the Amazon.com, Inc. autonomous system (AS16509) in the United States. The SSL certificate is issued by Google Trust Services under the WR1 intermediate, providing a false sense of security to visitors. Detection metrics confirm the domain's malicious status: 17 of 95 security vendors on VirusTotal flag the domain as phishing, while Google Safe Browsing has explicitly classified it as a phishing threat. Additionally, the domain appears on one security blocklist and is actively blocked by PhishDestroy, further corroborating its malicious intent. No legitimate registration or creation date is publicly available, suggesting the domain was provisioned specifically for this campaign. Users who have visited united-airlines-inky.vercel.app or entered credentials on the site should immediately revoke any submitted login details through official channels. Credentials should be changed across all platforms where identical or similar passwords were used, prioritizing corporate accounts and financial services. Network administrators are advised to block the domain and its resolving IP address (216.198.79.67) at the perimeter level to prevent further exposure. Affected individuals should monitor accounts for unauthorized activity and enable multi-factor authentication where available. Organizations should conduct internal awareness training to reinforce recognition of cloud-hosted phishing domains and the risks associated with credential harvesting attacks.