moriwin[.]vercel[.]app

The domain moriwin.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. and is currently flagged as an active generic phishing site under investigation. It appears on a single security blocklist and has been explicitly blocked by PhishDestroy, indicating that threat intel sources have identified it as a malicious credential‑harvesting host. The risk level remains under investigation pending further behavioral analysis.

Infrastructure analysis shows the domain resolves to IP address 64.29.17.195, which is hosted in the United States and belongs to ASN 16509, the Amazon.com, Inc. network. The site presents a valid SSL certificate issued by Google Trust Services under the WR1 certificate profile, and the connection is protected by HTTP Strict Transport Security (HSTS). Vercel is identified as the underlying hosting platform, consistent with the certificate chain and observed response headers.

Web interaction data reveals an HTTP 200 response code despite the page title returning "404: NOT_FOUND," suggesting a potential content cloaking or redirection technique commonly used in phishing campaigns. The Gridinsoft trust score is recorded as 0 out of 100, reinforcing the malicious classification. VirusTotal currently reports zero detections out of 95 scanners, which reflects a lack of known signatures rather than an indication of safety.

Given the confirmed infrastructure and blocklist presence, defenders should proactively block moriwin.vercel.app at the DNS and proxy layers, monitor for any outbound communications to the associated IP, and incorporate the domain into existing phishing detection rules. Continuous traffic analysis is advised to capture any payloads or credential submissions that may be attempted, as the exact phishing landing page content remains undisclosed.