187tyesy[.]vercel[.]app

This domain, 187tyesy.vercel.app, presents a targeted credential theft operation impersonating the WP email platform, a widely used service in Poland. Analysis indicates the page title "Poczta - Najlepsza Poczta, największe załączniki - WP" directly mimics the legitimate WP webmail interface, designed to deceive users into entering login credentials. The threat specifically targets Polish-speaking individuals, leveraging brand familiarity to harvest usernames and passwords for subsequent unauthorized access or account takeover. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to IP address 64.29.17.3 and is hosted on infrastructure registered through Vercel Inc. Security vendors on VirusTotal have flagged this domain as malicious, with 14 out of 95 engines detecting it as a phishing threat. The SSL certificate issued by Google Trust Services provides a false sense of security, as the domain itself remains unverified and controlled by threat actors. No legitimate association with the WP brand or its official domains has been established. Users who have visited 187tyesy.vercel.app or entered credentials on this site should immediately take corrective action. Change passwords for the WP email account and any other services where identical credentials may have been reused. Enable multi-factor authentication on all critical accounts to mitigate the risk of unauthorized access. Monitor financial and communication platforms for signs of compromise, such as unauthorized login attempts or suspicious messages. Organizations should block this domain at the network level and update endpoint protection rules to prevent further exposure. Individuals should report the incident to their email provider and relevant cybersecurity authorities to assist in tracking and mitigating the threat.