taxcoder[.]vercel[.]app

This domain is classified as a high-risk threat due to its confirmed brand impersonation of PayPal, a financial services platform. The site employs social engineering techniques to deceive users into divulging sensitive credentials, aligning with the observed threat category of brand_impersonation. Analysis indicates the domain remains actively malicious, posing significant risk to unsuspecting visitors. Infrastructure analysis reveals the domain taxcoder.vercel.app is registered through Vercel Inc. and resolves to the IP address 64.29.17.195. The page title explicitly mimics PayPal, further corroborating the impersonation attempt. Google Safe Browsing has flagged the domain under the SOCIAL_ENGINEERING category. VirusTotal reports 19 out of 95 security vendors detecting the domain as malicious, while the SSL certificate is issued by Google Trust Services. No creation date is provided, but the domain remains active as of this assessment. Mitigation steps for this specific threat type include immediate blacklisting of the domain and associated IP address (64.29.17.195) across network security controls. Organizations should deploy email and web filtering rules to block access to taxcoder.vercel.app and monitor for related subdomains under vercel.app. End-user training should emphasize verification of domain authenticity before entering credentials, particularly for financial services. Security teams are advised to review logs for connections to 64.29.17.195 and investigate potential credential exposure incidents linked to this domain.