ax17-casefb651927[.]vercel[.]app

This domain, ax17-casefb651927.vercel.app, is identified as a credential harvesting phishing infrastructure designed to deceive users into submitting sensitive login information. The site mimics legitimate authentication portals, likely targeting corporate or financial service credentials, given its deployment on a cloud-based hosting platform commonly abused for phishing campaigns. Analysis of the domain's structure and hosting behavior suggests it was engineered for short-term malicious use, a tactic frequently employed to evade detection and takedown efforts. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on February 21, 2026, through Tucows Domains Inc., and currently resolves to the IP address 216.198.79.3, geolocated within the United States under AS16509 (Amazon.com, Inc.). Security vendor assessments on VirusTotal flag the domain as malicious, with 12 out of 95 engines detecting it as a phishing threat. Additionally, the domain appears on two independent security blocklists, further corroborating its malicious classification. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the risk, as phishing sites frequently leverage valid certificates to appear legitimate. Users who accessed ax17-casefb651927.vercel.app should assume potential exposure of credentials or other sensitive data. Immediate actions include revoking any entered credentials, particularly for corporate or financial accounts, and monitoring associated accounts for unauthorized activity. System-level scans for malware or browser-based data exfiltration artifacts are recommended, as phishing sites may deploy secondary payloads. Network administrators should block the domain and its resolving IP (216.198.79.3) at the perimeter to prevent further access. Given the domain's current offline status, continued vigilance is advised, as threat actors may redeploy similar infrastructure under new identifiers.