mismatesenvp2452452[.]vercel[.]app

This domain, mismatesenvp2452452.vercel.app, is identified as a high-risk phishing portal designed to mimic legitimate video streaming services under the guise of "Video Diversión." Analysis indicates the site employs social engineering tactics, presenting itself as an entertainment platform to deceive users into interacting with malicious content. No direct evidence of a cryptocurrency drainer or credential harvester was observed in initial scans, though the page title and structure suggest an intent to distribute malware or collect user data through fraudulent media playback prompts. The domain does not appear to impersonate a specific brand but instead relies on generic video-related lures to attract victims. Infrastructure analysis reveals the domain is hosted on Vercel Inc. infrastructure, resolving to the IP address 64.29.17.195, located in the United States. The domain was registered through Vercel Inc. on April 21, 2026, though this creation date may reflect a default or placeholder value, as Vercel domains are often dynamically generated. As of the latest assessment, the domain is flagged by 14 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It appears on a single security blocklist and is not currently listed in Google Safe Browsing. The SSL certificate is issued by Google Trust Services (WR1), providing an illusion of legitimacy while masking the underlying malicious intent. The domain remains active and continues to pose a significant risk to unsuspecting users, particularly those seeking free or unauthorized media content. Response actions by security vendors have been limited, with only one known blocklist (PhishDestroy) currently mitigating exposure. The low detection rate relative to the total number of vendors suggests the campaign may still be in an early or evasive phase. Users are advised to avoid interacting with the domain, and network administrators should implement blocking measures at the DNS or IP level. Given the domain’s hosting on a legitimate cloud platform, takedown efforts may require direct coordination with the provider to disrupt the phishing infrastructure.