messenger-clone-beta[.]vercel[.]app

This domain is flagged as a credential theft operation targeting users of a popular messaging platform. The site mimics legitimate login interfaces to harvest account credentials, including usernames, passwords, and potentially multi-factor authentication codes. Such stolen credentials are frequently exploited for account takeovers, unauthorized access to sensitive communications, or further social engineering attacks against contacts in the victim's network.

Analysis indicates the domain is hosted on infrastructure associated with Vercel Inc., resolving to IP address 64.29.17.3. As of the latest scan, 22 out of 95 security vendors on VirusTotal have detected malicious activity linked to this domain. The SSL certificate is issued by Google Trust Services, which does not mitigate the inherent risk posed by the site's content or intent. No legitimate service or affiliation with the impersonated brand has been verified.

If you have visited messenger-clone-beta.vercel.app or entered any login details, immediately cease all interaction with the site. Reset passwords for any accounts accessed from the same device or browser session, prioritizing email and financial services. Enable multi-factor authentication where available, using app-based or hardware tokens instead of SMS-based methods. Monitor accounts for unauthorized activity, including sent messages, login attempts, or changes to security settings. Consider scanning the device used to access the site for malware, as credential theft sites may deploy additional payloads to maintain persistence.