listed-livegrabs26[.]vercel[.]app

Analysis of listed-livegrabs26.vercel.app indicates that the domain was registered on February 21, 2026 through Tucows Domains Inc. The authoritative name resolution points to the IP address 64.29.17.131, which is allocated to Amazon.com, Inc. (AS16509) and geolocated in the United States. An HTTPS endpoint is presented using a certificate issued by Google Trust Services under the WR1 label, confirming the use of a legitimate certificate authority but not mitigating malicious intent. HTTP requests to the host return status code 451, and the page title reported by crawlers is “Deployment Unavailable,” suggesting that the site was taken offline at the time of observation. The domain appears on four independent phishing blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating consensus among threat‑intelligence feeds that the site was employed for phishing.

VirusTotal analysis recorded 16 positive detections out of 93 scanned scanners, reinforcing the classification as a malicious phishing resource. The combination of a recently created domain, cloud‑based hosting, and a valid SSL certificate is consistent with typical phishing infrastructure that seeks to evade simple reputation checks. While the current HTTP response indicates the site is no longer serving content, historical evidence confirms that the domain was active as a generic phishing vector.

No additional intelligence regarding the specific lure, credential‑stealing kit, or targeted brand is available. Defenders should continue to block the domain at network perimeter devices, update URL filtering policies to include the listed blocklist identifiers, and monitor for any re‑use of the underlying IP address or similar Vercel‑hosted subdomains. Ongoing observation of the registrar’s activity may reveal future campaigns that reuse the same registration channel.