messenger-clone-three[.]vercel[.]app

This domain, messenger-clone-three.vercel.app, was registered through Vercel Inc. on June 17 2026 and is hosted on an Amazon‑owned IP address (64.29.17.131, AS16509, United States). The site returns HTTP 200 and presents a valid SSL certificate (labelled WR1). Passive fingerprinting identifies Vercel and HTTP Strict Transport Security (HSTS) as the primary technologies. VirusTotal analysis shows 18 of 91 security vendors flagging the host, indicating a moderate to high confidence of malicious intent. The page title “Messenger Clone” and the classification as a credential phishing campaign, specifically using an “Airdrop Scam” kit, suggest the infrastructure is designed to harvest user credentials. The domain appears on one public blocklist and is already blocked by PhishDestroy; Gridinsoft assigns a trust score of 0 / 100. No nameserver records were returned, and no additional forensic content has been published, leaving the exact login flow and payload unknown. Defenders should add the FQDN to URL filtering and sink‑hole lists, enforce TLS inspection, and monitor for related traffic to the resolved IP. Ongoing observation is advised to capture any evolution of the phishing kit or targeting patterns.