confira-desconto[.]vercel[.]app

This domain is flagged as a high-risk phishing site employing a fake discount countdown timer to deceive users into disclosing sensitive information or executing unauthorized transactions. The page title, 'Contagem Regressiva,' suggests a time-sensitive scam, a common tactic to create urgency and bypass user scrutiny. Analysis indicates this is not a generic phishing attempt but a targeted scheme designed to mimic legitimate promotional offers, likely aiming to harvest credentials or financial data. Infrastructure analysis reveals the domain confira-desconto.vercel.app is registered through Vercel Inc. and resolves to the IP address 64.29.17.195, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain was created on March 07, 2026, though the SSL certificate, issued by Google Trust Services (WR1), suggests recent activation. It appears on one security blocklist (PhishDestroy) and is flagged by 17 out of 95 security vendors on VirusTotal, indicating moderate but growing detection coverage. The discrepancy between the domain creation date and current activity may point to either a typo-squatting attempt or delayed malicious deployment. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (64.29.17.195) at the network perimeter. Security teams should prioritize monitoring for user interactions with countdown-themed phishing pages, particularly those hosted on Vercel or other cloud-based platforms. Endpoint protection rules should be updated to detect and prevent access to domains with 'desconto' or similar discount-related keywords in the URL. User awareness training should emphasize the risks of time-sensitive offers, especially those lacking verifiable branding or originating from non-corporate domains. Logs from web proxies and DNS resolvers should be reviewed for historical connections to this domain to assess potential compromise.