ze-deliveryonline[.]vercel[.]app

This domain, ze-deliveryonline.vercel.app, is actively engaged in a delivery scam operation designed to deceive users by impersonating Zé Delivery, a legitimate beverage delivery service. The site presents itself as an "exclusive link" to trick victims into entering personal information, payment details, or downloading malicious content. Such scams typically aim to harvest credentials, install malware, or facilitate unauthorized transactions under the guise of a trusted brand. The fraudulent nature of this domain is reinforced by its use of social engineering tactics, including urgency and exclusivity claims, to manipulate user behavior. Analysis indicates this domain is hosted on Vercel Inc. infrastructure and resolves to the IP address 64.29.17.131, located within Amazon.com, Inc.'s AS16509 network in the United States. The SSL certificate is issued by Google Trust Services (WR1), a common practice among threat actors to lend an appearance of legitimacy. As of the latest scan, 12 out of 95 security vendors on VirusTotal have flagged this domain as malicious, confirming its involvement in phishing or scam activity. The domain appears on one security blocklist and remains unblocked by most major browsers or security tools, increasing its potential reach. Its registration through Vercel, a platform often abused for rapid deployment of fraudulent sites, further complicates takedown efforts due to the transient nature of such deployments. Users who have visited ze-deliveryonline.vercel.app or interacted with its content should take immediate action to mitigate potential risks. First, disconnect the device from the network to prevent further data exfiltration or malware propagation. Run a full system scan using updated antivirus or endpoint detection tools to identify and remove any malicious payloads. If personal or financial information was entered, contact the relevant institutions to report potential fraud and monitor accounts for unauthorized activity. Reset passwords for any accounts accessed on or near the compromised device, prioritizing email, banking, and payment platforms. Report the domain to local cybersecurity authorities or consumer protection agencies to aid in broader mitigation efforts. Avoid clicking on any links or downloading attachments from unsolicited messages, even if they appear to originate from known services.