messenger-clone-eight[.]vercel[.]app

This domain, messenger-clone-eight.vercel.app, operates as a credential harvesting phishing site designed to mimic legitimate instant messaging platforms. Analysis indicates the infrastructure is specifically engineered to deceive users into submitting account credentials, which are then captured for unauthorized access or secondary attacks. The cloned interface closely resembles official messaging services, increasing the likelihood of successful compromise for unsuspecting victims. Infrastructure analysis reveals the domain is hosted on Vercel Inc. infrastructure, resolving to IP address 216.198.79.3. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. As of the latest scan, 14 out of 95 security vendors on VirusTotal have flagged this domain as malicious, with detection labels including 'phishing' and 'credential_theft.' The domain's registration through a legitimate hosting provider complicates takedown efforts, as it leverages trusted infrastructure to evade initial scrutiny. Users who have visited messenger-clone-eight.vercel.app or entered credentials on the site should immediately revoke any submitted login details from their official accounts. Multi-factor authentication should be enabled where available to mitigate unauthorized access. Network administrators are advised to block the domain and its associated IP address (216.198.79.3) at the perimeter. Affected users should monitor their accounts for suspicious activity, including unauthorized logins or messages sent from their profiles. Given the elevated risk level, organizations should treat this domain as an active threat and prioritize awareness training to prevent further compromise.