easybank-landing-page-dngtnv[.]vercel[.]app

Analysis of the domain easybank-landing-page-dngtnv.vercel.app, observed on July 25 2026, shows a high‑risk brand‑impersonation campaign targeting Facebook users. The site is hosted on Vercel infrastructure (nameservers ns1.vercel-dns-3.com, ns2.vercel-dns-3.com, ns3.vercel-dns-3.com, ns4.vercel-dns-3.com) and resolves to the Amazon‑owned address 64.29.17.131 (AS16509). The TLS certificate is issued by Google Trust Services under the WR1 profile, and the server advertises HTTP Strict Transport Security. The HTTP response code is 200, indicating that the page is reachable.

The page title returned by the server is “Frontend Mentor | Easybank landing page”, which does not reference the Facebook brand but aligns with the observed scam type of social‑media phishing. VirusTotal has recorded 20 detections out of 93 scanned vendors, and the domain is listed on at least one public phishing blocklist, where it is also flagged by PhishDestroy. Trust metrics are extremely low: Gridinsoft assigns a score of 0/100 and Scamadviser a score of 1/100, reflecting a lack of reputation. The domain was created on 28 January 2020 and was registered through Vercel Inc., a legitimate cloud provider often abused for malicious campaigns.

The combination of active status, high‑risk classification, confirmed phishing indicators, and the use of reputable hosting to obscure malicious intent makes the domain a priority for remediation. Defenders should block the hostname and its resolved IP at network perimeters, add the domain to internal URL filtering lists, and monitor for DNS queries to the listed Vercel nameservers. Continuous re‑scanning with multi‑engine scanners is recommended to detect any changes in detection ratios. Incident response teams should also consider correlating user‑reported Facebook credential submissions with this indicator to identify potential compromise.