casefb567629-utbg[.]vercel[.]app

Analysis of the domain casefb567629-utbg.vercel.app indicates a high-risk phishing campaign leveraging Vercel's hosting infrastructure. The domain, registered through Tucows Domains Inc. on February 21, 2026, resolves to IP address 64.29.17.67, hosted on Amazon.com, Inc.'s AS16509 network in the United States. At the time of assessment, the domain returned an HTTP 451 status code and displayed a 'Deployment Unavailable' page title, though this may reflect takedown efforts rather than original malicious content. Security vendor detections on VirusTotal show 14 of 93 engines flagging the domain, while Google Safe Browsing explicitly classifies it as social engineering. The domain appears on at least one security blocklist, specifically PhishDestroy.

SSL certification is provided by Google Trust Services (WR1), and HTTP Strict Transport Security (HSTS) is enforced, which may complicate user warnings despite the malicious intent. Infrastructure analysis reveals the use of Vercel's platform, a common vector for rapidly deployed phishing sites due to its free tier and ease of use. The registrar, Tucows, is frequently observed in abuse reports but lacks real-time enforcement capabilities. The IP address has no prior associations with confirmed benign domains in recent threat intelligence feeds, though historical context remains unverified. Defenders should treat this domain as actively malicious until further analysis confirms remediation.

Network-level blocking of 64.29.17.67 and domain-level filtering are recommended. Given the social engineering classification, user education on recognizing phishing attempts remains critical. The domain's current offline status suggests takedown efforts, but similar infrastructure may reappear under different subdomains or IPs. Continuous monitoring of Vercel-hosted subdomains with randomized naming patterns is advised.