ughfjdu-ten[.]vercel[.]app

PhishDestroy has identified ughfjdu-ten.vercel.app as a credential theft domain actively engaging in phishing campaigns. This subdomain, hosted on Vercel Inc.'s infrastructure, is designed to mimic legitimate services in an attempt to trick users into revealing sensitive login credentials or personal information. The domain resolves to IP address 216.198.79.67 and leverages a Google Trust Services SSL certificate to appear legitimate, a common tactic among threat actors to evade detection and build trust with potential victims. Analysis indicates this domain is part of a broader campaign targeting unsuspecting users, with the goal of harvesting credentials for subsequent fraudulent activities. This domain was flagged by multiple security vendors, with 22 out of 95 VirusTotal engines detecting malicious activity. It has also been included on the OISD blocklist, further corroborating its malicious nature. The domain was created recently and registered through Vercel Inc., a legitimate cloud platform often exploited by threat actors for hosting phishing infrastructure due to its trusted reputation. The combination of a recent registration date, low detection ratio among vendors, and active hosting on a reputable platform highlights the sophisticated nature of this threat. Additionally, the domain's SSL certificate, issued by Google Trust Services, adds a layer of deception, making it harder for users to discern its malicious intent. If you have visited ughfjdu-ten.vercel.app, immediately change any passwords or credentials that may have been entered on the site. Enable multi-factor authentication (MFA) on all accounts that support it, as this can provide an additional layer of security even if credentials were compromised. Monitor your accounts for any unusual activity, such as unauthorized transactions or changes to account settings. Consider running a malware scan on your device using reputable antivirus software to ensure no additional threats have been introduced. Finally, report the domain to your organization's security team or to relevant authorities, such as your country's cybercrime reporting center, to help prevent further victimization. Staying vigilant and proactive is key to mitigating the risks associated with credential theft domains like this one.