goojp[.]vercel[.]app

PhishDestroy identifies goojp.vercel.app as an active credential harvesting domain masquerading as a legitimate service. The threat actor leverages a Vercel-hosted subdomain (goojp.vercel.app) to deploy a spoofed login portal, likely targeting unsuspecting users with fake authentication prompts. No known brand impersonation or drainer kit signatures were detected in this specific instance, suggesting a generic but effective phishing campaign designed to harvest credentials or session tokens. The domain’s structure and hosting environment indicate opportunistic abuse of trusted cloud platforms to evade traditional detection mechanisms.

Technical indicators confirm elevated risk: VirusTotal reports a detection ratio of 18/95 security vendors, while the domain resolves to IP 64.29.17.3 and operates under Google Trust Services’ SSL certificate. Registered through Vercel Inc., the domain shows no publicly available creation date, but its active status and GSB (Google Safe Browsing) flagging highlight its malicious nature. With at least 18 security vendors already blocking access, this domain is included in multiple threat intelligence blocklists, underscoring its widespread recognition as a phishing resource.

As of the latest analysis, goojp.vercel.app remains active and accessible, posing an ongoing risk to users who may encounter it through phishing emails, social media, or malvertising. Immediate actions include blocking the domain at the network level and updating endpoint protection rules to flag the IP (64.29.17.3) and SSL certificate issuer. While the current risk is elevated, the domain’s reliance on Vercel’s infrastructure may limit its longevity if reported and taken down promptly. Users are advised to avoid interacting with this domain, verify URLs before inputting credentials, and report any encounters to their security teams or threat intelligence platforms.