c9w[.]fi

c9w.fi is an actively‑registered domain that resolved on 2026-07-12 to the Cloudflare address 104.21.17.252. The site returns an HTTP 301 response and serves a page titled “Vercel Security Checkpoint”. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS connection. Registration occurred on 2026-06-18 through Key-Systems GmbH, and the domain is delegated to the Cloudflare nameservers dakota.ns.cloudflare.com and evelyn.ns.cloudflare.com.

Multiple threat‑intelligence sources have classified the site as a generic phishing landing page. The domain appears on four security blocklists and has been actively blocked by solutions such as SEAL, MetaMask, PhishDestroy and BLP-Malware. AlienVault OTX references the domain in fourteen separate pulses, reinforcing its association with phishing campaigns. Despite the 0/95 detection rate on VirusTotal, the convergence of blocklist listings and pulse citations provides strong corroboration of malicious intent.

Current intelligence gaps include the specific payload or credential‑harvesting technique employed and the identity of any threat actors behind the infrastructure. Analysts should treat c9w.fi as high‑risk and enforce network‑wide blocking, monitor DNS queries for the domain and its associated IP, and inspect any inbound traffic that follows the HTTP 301 redirect. End‑user awareness messaging should reference the “Vercel Security Checkpoint” page title to aid in identification, and any observed login attempts to legitimate services should be scrutinized for credential reuse.