file-documents-ja8e29d3a3c4a5e6f7g8[.]vercel[.]app

This domain, file-documents-ja8e29d3a3c4a5e6f7g8.vercel.app, is flagged as a high-risk phishing site specializing in brand impersonation. Analysis indicates the threat actor has cloned the WeTransfer file-sharing interface, as evidenced by the page title 'WeTransfer - Download Files.' The domain does not deploy a known crypto drainer kit but instead appears designed to harvest login credentials or distribute malicious payloads under the guise of legitimate file downloads. Infrastructure analysis reveals the following technical indicators: VirusTotal detection score of 20/95 security vendors, registration through Vercel Inc., and resolution to IP address 64.29.17.131 (AS16509, Amazon.com, Inc., US). The SSL certificate is issued by Google Trust Services (WR1), a common tactic to lend false legitimacy. The domain appears on one security blocklist and is actively blocked by PhishDestroy. No Google Safe Browsing (GSB) listing is currently recorded, though this may reflect a lag in propagation rather than a clean status. Current status remains active, with no evidence of takedown or sinkholing. The domain continues to resolve and serve content, posing an ongoing risk to users. Response actions should include immediate blacklisting in enterprise security controls, DNS filtering at the resolver level, and endpoint protection rules to block access. Remaining risk is elevated due to the domain's use of a trusted registrar and SSL certificate, which may delay user recognition of the threat. Organizations are advised to monitor for related domains using the same Vercel subdomain pattern and to educate users on verifying file-sharing URLs before entering credentials or downloading content.