segurit-incrit-ec[.]vercel[.]app

This domain, segurit-incrit-ec.vercel.app, is identified as an active credential phishing site targeting Banco Pichincha customers. Analysis confirms the domain is currently operational and designed to harvest login credentials, financial details, or personal information under the guise of the legitimate financial institution. The page title explicitly mimics Banco Pichincha, a well-known banking entity, increasing the likelihood of successful deception among its user base. Infrastructure analysis reveals the domain was registered on May 17, 2026, through Vercel Inc. and resolves to the IP address 216.198.79.131, hosted within a provider known for rapid deployment of temporary or disposable infrastructure. Detection metrics indicate 22 of 95 security vendors on VirusTotal have flagged the domain as malicious, while Google Safe Browsing has classified it as phishing. The domain appears on at least one security blocklist, and its SSL certificate is issued by Google Trust Services (WR1), a common tactic to lend superficial legitimacy to fraudulent sites. The creation date, set in the future, suggests potential domain spoofing or misconfiguration, though this does not diminish its current operational threat. The domain remains active as of the latest verification, posing an ongoing risk to individuals and organizations associated with Banco Pichincha. Immediate mitigation steps are recommended, including blocking the domain and its resolving IP at the network perimeter, updating endpoint protection signatures, and alerting users to the specific threat. Financial institutions and security teams should monitor for related domains leveraging similar naming conventions or infrastructure patterns. Incident responders are advised to preserve logs containing interactions with this domain for forensic analysis, as compromised credentials may lead to follow-on attacks such as account takeovers or fraudulent transactions.