portalveicular-sc[.]vercel[.]app

PhishDestroy identifies portalveicular-sc.vercel.app as a credential theft page masquerading as a vehicle portal, likely harvesting login details for fraudulent access. The page mimics a legitimate service, suggesting a brand impersonation tactic aimed at capturing user credentials for downstream account takeovers or financial fraud. No crypto drainer kit or specific malware payload has been observed in sandbox analysis, but the domain’s structure and naming imply a focused campaign against vehicle-related services.

Technical indicators confirm the domain’s recent activation and low detection rate: VirusTotal shows 0/95 detections as of latest scan, while the domain resolves to IP 64.29.17.131 via Vercel Inc. The SSL certificate is issued by Google Trust Services, and the domain remains unflagged by Google Safe Browsing (GSB status: under_investigation). Registration occurred through Vercel’s platform, suggesting abuse of a legitimate hosting provider to evade takedown efforts. No blocklist entries have been recorded at this time, indicating an early-stage campaign with limited exposure.

This domain remains active and under investigation, with a current risk level classified as under_investigation. Hosting provider takedown requests have been initiated via Vercel’s abuse channel, and network defenders are advised to block the IP 64.29.17.131 and domain at the firewall level. Users should avoid accessing the site and report any accidental access to their security teams. While the immediate threat is contained through monitoring, the low detection rate and use of a reputable hosting service pose a persistent risk of escalation if undetected. Continuous monitoring of new registrations and behavioral anomalies is recommended.