infinite-wonderbox15[.]vercel[.]app

The domain infinite-wonderbox15.vercel.app was registered through Tucows Domains Inc. on 21 February 2026. It resolves to the Amazon Web Services address 64.29.17.131, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. The TLS certificate presented by the host is issued by Google Trust Services under the WR1 label, indicating a valid certificate chain but offering no indication of malicious intent beyond the underlying content. Automated scans show that Google Safe Browsing has classified the site as a social‑engineering threat.

VirusTotal reports that 12 of 93 scanning engines have flagged the domain, suggesting a moderate level of consensus among security vendors. The domain appears on two public blocklists, specifically PhishDestroy and ScamSniffer, and the HTTP response code returned when the site was queried was 451, which denotes “Unavailable for Legal Reasons”. The page title displayed at the time of capture was “Deployment Unavailable”, and the site advertised the Vercel platform with HTTP Strict Transport Security (HSTS) enabled. Because the infrastructure is hosted on a legitimate cloud provider and the certificate is valid, static indicators such as the IP address or TLS issuer alone are insufficient to prove malicious activity.

However, the combination of the Safe Browsing classification, multiple vendor detections, and inclusion on phishing‑specific blocklists provides strong evidence that the domain was being used for a generic phishing campaign before it was taken offline. Defenders should continue to block the domain at perimeter filters, update intrusion‑detection signatures with the observed IP address and domain name, and monitor for any re‑registration of similar subdomains under the same registrar. Incident response teams should also consider correlating internal logs for any attempted connections to 64.29.17.131 after the reported date, as attackers may have reused the same hosting resources.