acordo-certo[.]vercel[.]app

The domain acordo-certo.vercel.app is currently active and engaged in credential theft operations. Analysis indicates the site presents fraudulent login interfaces designed to capture user credentials, including usernames, passwords, and potentially multi-factor authentication codes. No specific brand impersonation has been confirmed, but the infrastructure and tactics align with broad credential harvesting campaigns targeting financial, email, and social media accounts. Infrastructure analysis reveals the domain resolves to IP address 216.198.79.67, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The SSL certificate is issued by Google Trust Services (WR1), a common practice among phishing operators to mimic legitimacy. The domain is flagged by 17 of 95 security vendors on VirusTotal, with a presence on at least one security blocklist. Registration details confirm Vercel Inc. as the hosting provider, a platform frequently abused for rapid deployment of phishing pages due to its ease of use and free tier availability. No historical WHOIS data is available, suggesting recent registration or privacy protections in place. Current status remains active, with no signs of takedown or mitigation at the time of analysis. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include this indicator. Users should be educated on recognizing phishing tactics, particularly those involving fake login prompts or urgent requests for credentials. Security teams should monitor for related domains using the same hosting provider or IP range, as additional malicious infrastructure may emerge. If credentials were entered on this site, immediate password resets and account audits are recommended, along with enabling multi-factor authentication where available.