openselimited-grab[.]vercel[.]app

Analysis of openselimited-grab.vercel.app shows a short‑lived deployment that was taken offline after detection. The domain was registered on February 21, 2026 through Tucows Domains Inc. and immediately pointed to the Amazon Web Services address 216.198.79.131, which belongs to AS16509 (Amazon.com, Inc.) and resolves to a United States location. The TLS certificate presented is issued by Google Trust Services under the WR1 root, indicating a valid, publicly trusted HTTPS endpoint. Fingerprinting of the web stack reveals Vercel hosting and the presence of HTTP Strict Transport Security (HSTS).

Requests to the site return HTTP 451, and the only visible page title is “Deployment Unavailable,” suggesting the underlying application was removed or disabled. The domain appears on a single public blocklist and has been flagged by PhishDestroy as malicious. VirusTotal scans report 12 of 93 security vendors classifying the domain as malicious, reinforcing the suspicion of abuse.

No further page content or phishing kit details have been disclosed, so the exact credential‑harvesting vector remains unknown. Defenders should continue to block the domain and its associated IP address, monitor for any re‑registration or new DNS records, and add the host to internal URL filtering policies. Given the recent creation date and the confirmed malicious classification, proactive containment is advised to prevent potential victims from encountering the site if it resurfaces.