newcase-amber[.]vercel[.]app

Analysis of newcase-amber.vercel.app shows a domain hosted on Vercel infrastructure that was actively serving a Facebook‑related phishing page before being taken offline. The site responded with HTTP status code 451, indicating a legal restriction response, and the TLS certificate presented is issued by Google Trust Services under the WR1 intermediate, confirming a valid HTTPS endpoint. DNS resolution points to IP address 216.198.79.3, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, matching the registration through Vercel Inc. The page title returned by the server is “Meta for Business - Page Appeal”, a phrase commonly associated with Facebook’s business services, reinforcing the claim that the domain was intended to impersonate Facebook.

VirusTotal scans recorded 16 detections out of 95 security vendors, indicating a moderate level of malicious classification. The domain appears on one public security blocklist and is currently blocked by the PhishDestroy service. Detected technologies include Vercel hosting and HTTP Strict Transport Security (HSTS).

The available evidence confirms a brand‑impersonation campaign targeting Facebook users, but the exact phishing kit, credential capture mechanism, and distribution channels remain unknown because the site is offline and no page content has been captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration or similar Vercel‑hosted subdomains, and consider sharing the indicator set with threat‑intel sharing platforms. Ongoing observation of the IP address 216.198.79.3 for new malicious activity is advised, as the hosting provider may be reused for future campaigns.