openopenbox304[.]vercel[.]app

Analysis of openopenbox304.vercel.app indicates that the domain was actively used for a phishing campaign before being taken offline. The site returned HTTP status 451, signalling that the deployment was unavailable, and the page title reflected the same message. Technical fingerprints show the presence of Vercel hosting with HSTS enforced, and the TLS certificate was issued by Google Trust Services under the WR1 label, confirming a legitimate certificate chain. DNS resolution points to IP address 64.29.17.3, which belongs to AS16509 Amazon.com, Inc., locating the infrastructure in the United States.

Registration details list Vercel Inc. as the registrar, and the nameserver query returned NS_NOT_FOUND, indicating that standard authoritative records are missing or obscured. VirusTotal scans flagged the domain with 15 out of 95 security vendors, providing a moderate to high confidence indication of malicious activity. Independent blocklists have already listed the domain, with four external blocklists and specific anti‑phishing services—PhishDestroy, Polkadot, Enkrypt, and Codeesura—explicitly blocking it. The cumulative evidence from vendor detections, blocklist entries, and hosting analysis substantiates the classification as a phishing site.

Because the domain is currently offline, active payloads cannot be examined, leaving the exact phishing vector and targeted brand unknown. Defenders should maintain the domain on deny lists, monitor the associated IP range for any rehosted malicious content, and ensure that any outbound requests to the IP are blocked. Continuous watch on Vercel‑hosted assets and periodic re‑scans are recommended to catch potential re‑deployment under a new subdomain or variant.