ai-wine-ten[.]vercel[.]app

Analysis of ai-wine-ten.vercel.app shows that the domain was registered on 21 February 2026 through Tucows Domains Inc. The DNS resolves to the IP address 216.198.79.67, which belongs to the Amazon.com, Inc. network (AS16509) located in the United States. The site served a TLS certificate issued by Google Trust Services under the WR1 program, indicating a valid HTTPS handshake at the time of observation. HTTP requests to the host returned status code 451, and the service has since been taken offline. VirusTotal records indicate that 2 of 93 scanning engines flagged the domain, confirming the presence of malicious indicators.

The domain appears on five external blocklists, specifically PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, reinforcing its classification as a phishing‑related resource. The only content element captured was the page title “AI Hunt,” which does not provide further context about the intended victim lure. The combination of recent registration, Amazon‑hosted infrastructure, a legitimate‑looking SSL certificate, and multiple independent blocklist listings suggests a purposeful attempt to lend credibility to a phishing operation. However, the offline state limits immediate exposure, and no additional payload or credential‑stealing mechanisms have been observed.

Uncertainty remains regarding the specific content that was delivered before takedown, the targeted brand or service, and whether automated credential harvesting was employed. Defenders should continue to block the domain at DNS and proxy layers, monitor outbound connections to the associated IP address, and ensure that any cached redirects are purged. Organizations using threat‑intel feeds should retain the blocklist entries, and incident response teams should treat any residual traffic to the IP as potentially malicious. Ongoing surveillance of related subdomains in the Vercel hosting environment is advised, as the infrastructure could be reused for future campaigns.