stunning-octo-fiesta[.]vercel[.]app

This domain is flagged as an elevated-risk credential harvesting phishing site targeting user authentication data. Analysis indicates the infrastructure was designed to mimic legitimate services while capturing login credentials, financial details, or other sensitive information through deceptive input forms. Infrastructure analysis reveals the domain was registered through Vercel Inc. and currently resolves to IP address 198.18.59.181. The SSL certificate is issued by Google Trust Services (WR1), a common pattern observed in phishing campaigns attempting to appear legitimate. Security vendors on VirusTotal detected the domain with 20/95 flags, indicating moderate to high confidence in malicious classification. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and displays a page title of 'Deployment Unavailable,' a potential indicator of temporary takedown or evasion tactics. The domain is currently offline, suggesting possible remediation or operational pause by threat actors. Organizations should implement immediate mitigation steps to address this credential harvesting threat. Network-level blocking of the domain and associated IP address 198.18.59.181 is recommended to prevent access. Security teams should review logs for connections to this domain or IP, particularly from endpoints that may have interacted with the site prior to takedown. User awareness training should emphasize the risks of credential harvesting through deceptive domains, including verification of SSL certificates and scrutiny of domain names that closely resemble legitimate services. Monitoring for similar domains registered through Vercel or other hosting providers can help detect emerging threats in this campaign.