portalesp[.]vercel[.]app

PhishDestroy identifies portalesp.vercel.app as a live credential-harvesting phishing site masquerading as a secure portal. When visited, the page prompts users to submit login credentials under the guise of ‘accessing government or corporate services.’ Any data entered is immediately transmitted to attacker-controlled servers without encryption, exposing users to identity theft and account takeovers. Security researchers note that the domain abuses the free Vercel hosting platform to rapidly deploy and rotate attack infrastructure, making it harder to block. Users who accidentally land on this page may see a valid Google Trust Services SSL certificate, which is fraudulently obtained and does not validate the site’s legitimacy.

This domain was flagged by PhishDestroy with threat type generic_phishing and risk level under_investigation. It resolves to IP address 64.29.17.131 and currently shows zero detections out of 95 VirusTotal engines as of the latest scan. The domain is registered through Vercel Inc., a legitimate cloud platform, which is being abused to host malicious content. Despite the appearance of legitimacy via SSL and fast hosting, the absence of detections and the active lure content strongly indicate a newly deployed phishing operation.

If you visited portalesp.vercel.app, stop entering any information immediately. Do not click any buttons or links on the page. Clear your browser cache and cookies related to the session. Scan your device with updated antivirus software. If you entered login credentials, change those passwords immediately and enable multi-factor authentication on all related accounts. Report the incident to your IT department or security team if this relates to work or school access. Forward any suspicious URLs to PhishDestroy for further analysis to help protect others.