janera-jsdfjsjds-projects[.]vercel[.]app

The domain janera-jsdfjsjds-projects.vercel.app was observed hosting a brand‑impersonation campaign targeting Orange. Technical telemetry shows the site was built on the Vercel platform and served over HTTPS with an HSTS header, indicating transport‑layer security enforcement. The TLS certificate is issued by Google Trust Services under the WR1 identifier, a common certificate authority for Vercel‑hosted sites. HTTP response code 451 was returned, signalling that the content was unavailable for legal reasons, consistent with the reported offline status. DNS resolution points to IP address 216.198.79.67, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain’s nameserver information could not be retrieved (NS_NOT_FOUND), suggesting either a misconfiguration or deliberate concealment of name‑server details. Registration data indicates the domain was created on 2025‑03‑08 and was registered through Vercel Inc., matching the observed hosting technology.

Threat intelligence from VirusTotal reports that 18 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of a phishing or impersonation operation. The site appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed, providing immediate actionable indicators for network defenders. The page title retrieved from the site, “Identifiez‑vous”, is a French phrase meaning “Identify yourself”, which aligns with credential‑harvesting attempts often used in brand‑impersonation schemes.

Given the convergence of a Vercel‑hosted infrastructure, a valid SSL certificate, a legal‑error HTTP status, and multiple vendor detections, the domain should be treated as confirmed malicious. Defensive actions should include adding the domain and its resolved IP address to deny‑list rules across proxy, firewall, and endpoint protection systems.