tomsheavyequipment[.]vercel[.]app

This domain, tomsheavyequipment.vercel.app, is identified as a high-risk brand impersonation threat targeting Microsoft. Analysis indicates the infrastructure was established to mimic Microsoft’s official branding, likely for credential theft or fraudulent account access. No crypto drainer kit signatures were observed, but the domain’s structure and hosting align with known phishing campaigns impersonating enterprise software providers. Infrastructure analysis reveals the domain was registered on March 11, 2026, through Vercel Inc., resolving to IP address 64.29.17.195 (AS16509, Amazon.com, Inc., US). Security vendor assessments report 5/95 detections on VirusTotal, with Google Safe Browsing explicitly flagging the domain as phishing. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WR1). The page currently returns a 404: NOT_FOUND status, though this may indicate temporary takedown or evasion tactics. As of the latest verification, tomsheavyequipment.vercel.app remains active, posing a residual risk to users. The domain’s hosting provider and registrar should be notified for mitigation, and network defenders are advised to block the IP and domain at perimeter security controls. Organizations should monitor for credential reuse attempts stemming from this campaign, particularly targeting Microsoft account holders. The absence of visible content does not eliminate the threat; historical phishing pages may still be accessible via direct links or cached versions.