online-deutsch[.]vercel[.]app

The domain online-deutsch.vercel.app was registered on 2026-02-21 through Tucows Domains Inc. It resolves to IP 64.29.17.131, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The TLS certificate is issued by Google Trust Services under the WR1 intermediate, indicating use of Google’s managed certificate infrastructure. HTTP response code 451 indicates that the resource is unavailable for legal reasons, and the page title returned is "Deployment Unavailable", consistent with Vercel’s default error page when a deployment is removed. Security telemetry shows the domain is listed on a single blocklist, PhishDestroy, and VirusTotal reports 13 of 93 scanning engines flag the domain as malicious.

The site employs HSTS, as observed in the TLS handshake, which suggests an attempt to enforce HTTPS connections. Risk assessment classifies the domain as elevated generic phishing, but the site is currently offline, limiting immediate victim exposure. However, the infrastructure—Vercel hosting, a reputable certificate authority, and a cloud provider IP—demonstrates a pattern used by threat actors to gain trust. Uncertainties include the specific phishing campaign content, targeted brand, and whether the site previously served credential‑harvesting pages before being taken down.

No additional intelligence such as Safe Browsing or OTX entries is available. Defenders should continue to block the domain at the network perimeter, monitor DNS queries for the hostname, and consider adding the IP 64.29.17.131 to threat‑intel feeds. Periodic re‑resolution checks are advised in case the attacker reactivates the deployment. Correlation with other Vercel‑hosted phishing incidents may help identify related actors.