secure-portal-3888[.]vercel[.]app

The domain secure-portal-3888.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. It resolves to the IP address 64.29.17.195, which is announced by AS16509 Amazon.com, Inc. and geolocated in the United States. The site is hosted on Vercel and enforces HTTP Strict Transport Security (HSTS). Its TLS certificate is issued by Google Trust Services under the WR1 label, indicating a valid HTTPS endpoint despite the site’s current offline state. HTTP probing returned a 404 status code and the page title reported "404: NOT_FOUND," confirming that the content is no longer publicly accessible.

VirusTotal analysis recorded a single positive detection out of 93 security vendors, suggesting that at least one scanner identified malicious characteristics. The domain appears on one security blocklist and has been actively blocked by the PhishDestroy service. Gridinsoft assigned a trust score of 0 out of 100, reflecting a highly suspicious reputation. The observed indicators collectively point to a credential‑phishing campaign that leveraged the Vercel platform to host a fraudulent portal, likely intended to harvest login credentials.

However, the exact phishing page content, target brand, and victim interaction flow remain unknown because the site is offline and no detailed page capture is available. Defenders should add the domain and its resolving IP to deny‑list controls, monitor for any resurgence of activity, and correlate internal logs for attempts to contact the domain. Continuous scanning of the IP range associated with AS16509 is advised, as the hosting provider may be reused for future phishing infrastructure.