tommbtaq[.]vercel[.]app

This domain, tommbtaq.vercel.app, operates as a credential harvesting phishing site targeting users of a Polish webmail service. The page displays a fraudulent login interface under the title 'Poczta - Najlepsza Poczta, największe załączniki - WP,' designed to deceive visitors into entering their email credentials. Attackers use this tactic to collect usernames and passwords, which are then exploited for unauthorized access to accounts, financial fraud, or further phishing campaigns. The site poses a high risk due to its active status and targeted deception of users expecting legitimate email services. Analysis indicates the domain is hosted on Vercel Inc. infrastructure and resolves to the IP address 216.198.79.131, located within Amazon.com, Inc.'s AS16509 network in the United States. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the threat, as encryption is commonly used to lend false legitimacy to phishing sites. Security vendors have flagged the domain in 17 out of 95 detection engines on VirusTotal, and it appears on at least one security blocklist. The combination of active hosting, mimicked branding, and confirmed malicious detections confirms the domain's role in credential theft operations. If a user has visited tommbtaq.vercel.app or entered login details on the site, immediate action is required. First, change the passwords for any accounts using the same or similar credentials, prioritizing email, financial, and work-related services. Enable multi-factor authentication where available to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or sent messages, and report any anomalies to the service provider. Users should also scan their devices for malware, as phishing sites may deliver additional payloads. Finally, report the domain to local cybersecurity authorities or incident response teams to aid in mitigation efforts.