openopenbox303[.]vercel[.]app

openopenbox303.vercel.app is currently flagged as a high‑risk phishing infrastructure. The domain resolves to the Amazon‑owned IP 216.198.79.3 in the United States (ASN 16509) and is hosted on Vercel’s platform, as indicated by the technology fingerprint and the SSL certificate issued by Google Trust Services under the WR1 intermediate. The deployment page returns HTTP 451 with the title “Deployment Unavailable,” suggesting the site has been taken offline, which aligns with the reported status.

VirusTotal analysis shows that 16 of 95 scanned security engines label the domain as malicious, and five independent blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have already added it to their deny lists. The registrar information points to Vercel Inc., and the nameserver query returned NS_NOT_FOUND, further limiting attribution. HSTS is enforced, but that does not mitigate the phishing risk.

The combination of multiple vendor detections, blocklist listings, and the presence of a Google‑issued TLS certificate issued to a Vercel‑hosted deployment strongly indicates that the domain was used for credential‑stealing or similar phishing activity before being shut down. Defenders should continue to block the domain at network perimeter, update local blocklists with the identified identifiers, and monitor for any re‑registration or resurrection attempts that might reuse the same hosting provider or IP range. Ongoing vigilance is advisable because the underlying infrastructure (Vercel on Amazon AWS) remains publicly accessible and could be leveraged for future malicious campaigns.