casefb289520-0bwu[.]vercel[.]app

Analysis indicates that casefb289520-0bwu.vercel.app was provisioned on Vercel infrastructure on 21 February 2026 and is currently offline, returning HTTP 451 “Unavailable for Legal Reasons”. The TLS certificate is issued by Google Trust Services (WR1), confirming that the site used a legitimate certificate chain. Network resolution points to the IP address 216.198.79.3, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The hosting environment advertises Vercel and enforces HSTS, suggesting the attacker leveraged a legitimate cloud service to host the malicious payload. Reputation services have flagged the domain.

Google Safe Browsing lists it as a social‑engineering threat, and a single security blocklist has already added the domain. PhishDestroy has taken the site offline, and VirusTotal reports that 16 of 93 scanners identified malicious behavior, reinforcing the suspicion of phishing activity. The registrar is Tucows Domains Inc., a common registrar for short‑lived malicious domains. The only visible page title is “Deployment Unavailable”, which is typical for a taken‑down page and provides no further insight into the original content. No additional evidence such as landing‑page screenshots, credential‑harvesting forms, or targeted brand references is available, leaving the exact phishing vector uncertain.

Defenders should continue to block the domain at perimeter filters, update DNS blacklists with the resolved IP address, and monitor for any future reuse of the same IP or Vercel project identifier. Because the certificate is valid, downstream TLS inspection may be required to detect any re‑hosted payloads. Incident response teams should also query threat‑intel feeds for related indicators of compromise that share the same ASN or certificate issuer, as adversaries often recycle cloud resources. Ongoing vigilance is recommended until the domain remains fully offline.