usbankbusiness[.]vercel[.]app

This domain is flagged as a high-risk credential harvesting phishing site specifically targeting business banking customers. Analysis indicates the infrastructure is designed to mimic legitimate financial services login portals, with the intent to capture sensitive authentication credentials such as usernames, passwords, and multi-factor authentication codes. Infrastructure analysis reveals the domain usbankbusiness.vercel.app is hosted on IP address 64.29.17.3, geolocated within the United States under AS16509 (Amazon.com, Inc.). The domain is registered through Vercel Inc. and currently remains active. Security vendor detections on VirusTotal report 15 out of 95 engines flagging the domain as malicious. The domain appears on at least one security blocklist and is explicitly marked as phishing by Google Safe Browsing. The SSL certificate is issued by Google Trust Services (WR1), a common characteristic observed in phishing campaigns to lend false legitimacy. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address (64.29.17.3) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) across endpoint detection and response (EDR) systems, web proxies, and email security gateways to prevent user access. Organizations should also implement multi-factor authentication (MFA) enforcement for all business banking accounts to mitigate the impact of credential theft. Users who may have interacted with this domain should be instructed to reset their credentials immediately and monitor accounts for unauthorized transactions. Security awareness training should reinforce the identification of suspicious subdomains and URL patterns, particularly those hosted on third-party platforms such as Vercel.