ay-cyan[.]vercel[.]app

This domain, ay-cyan.vercel.app, is identified as a credential harvesting phishing site designed to impersonate the Bell Business authentication portal. Analysis indicates the page presents a fraudulent login interface under the title 'Bell Business Site,' aiming to deceive users into submitting corporate credentials. The infrastructure is hosted on a cloud-based platform, leveraging a legitimate service to evade initial detection and enhance perceived authenticity. The threat primarily targets business users, particularly those associated with the telecommunications sector, by exploiting brand recognition and urgency tactics commonly associated with account verification scams. Infrastructure analysis reveals the domain resolves to the IP address 216.198.79.195, geolocated within the United States and associated with AS16509, a major cloud provider. The domain was registered through Tucows Domains Inc. on February 21, 2026, though the creation date may reflect an attempt to appear legitimate or evade temporal-based detection mechanisms. Security vendor analysis on VirusTotal indicates 20 out of 95 engines flagged the domain as malicious, while it appears on one security blocklist. The SSL certificate, issued by Google Trust Services under the WR1 intermediate, further suggests an attempt to mimic secure connections, though this does not mitigate the underlying phishing threat. Users who visited ay-cyan.vercel.app or submitted credentials through the portal should immediately revoke and reset any exposed login details, particularly those associated with corporate or financial accounts. It is recommended to monitor linked accounts for unauthorized activity and enable multi-factor authentication where available. Organizations should update internal blocklists to include this domain and its associated IP address, while security teams are advised to conduct a retrospective analysis of network logs for connections to 216.198.79.195. Given the elevated risk level, affected users should report the incident to their internal security teams or relevant incident response authorities for further mitigation.