rewd[.]vercel[.]app

Analysis of the domain rewd.vercel.app confirms its classification as a phishing site impersonating State Bank of India (SBI), specifically targeting users through a PAN update scam. The domain, registered through Vercel Inc. on December 8, 2025, was flagged by 20 of 95 security vendors on VirusTotal, indicating elevated risk. It appears on one security blocklist and was actively blocked by PhishDestroy. Infrastructure analysis reveals the domain resolves to the IP address 216.198.79.3, hosted on Amazon.com, Inc. (AS16509) in the United States. The SSL certificate is issued by Google Trust Services (WR1), and the site employs HSTS alongside Vercel hosting technologies.

The page title, 'State Bank of India | PAN Update,' directly aligns with the scam type identified as brand impersonation. At the time of analysis, the domain returned an HTTP 451 status, suggesting it was taken offline or restricted due to legal or policy violations. No nameservers were detected, which may indicate an incomplete or hastily configured deployment. While the exact content of the phishing page remains unanalyzed, the combination of detection vendor flags, blocklist inclusion, and the explicit branding in the page title confirms the malicious intent.

Defenders should treat this domain as a confirmed phishing threat targeting SBI customers. The use of Vercel’s hosting platform is notable, as it may allow rapid redeployment under new subdomains. Organizations are advised to update blocklists to include rewd.vercel.app and monitor for related subdomains or IPs associated with this campaign. Given the domain’s offline status, further forensic analysis may be limited, but historical DNS and SSL certificate data could provide additional indicators of compromise.