vercel-gate-4efb64b860f457ab[.]vercel[.]app

The domain vercel-gate-4efb64b860f457ab.vercel.app was first flagged on 2026-08-02 as part of a generic phishing infrastructure. The sub-domain follows Vercel’s naming convention, indicating that the site is hosted on the Vercel cloud platform, which is frequently leveraged for temporary malicious pages because of its rapid provisioning capabilities. The only concrete evidence provided in the current intelligence set is that the domain has been blocked by the PhishDestroy feed and is listed on one external security blocklist.

No registrar details, ASN, country of registration, IP address, SSL certificate metadata, HTTP status codes, Safe Browsing verdicts, or Open Threat Exchange (OTX) identifiers have been disclosed. Consequently the underlying hosting infrastructure, certificate issuance timeline, and any associated redirection behavior remain unknown. The absence of additional vendor detections limits the ability to corroborate the threat with broader ecosystem signals, but the explicit block action by PhishDestroy indicates that the domain is actively being used to host malicious content, most likely a credential-harvesting page.

Defensive recommendations include adding the fully qualified domain name to network and endpoint deny lists, configuring DNS sinkholing for the domain and any future sibling sub-domains, and educating users to reject unsolicited emails or messages that reference the domain. Continuous monitoring of passive DNS records, TLS fingerprint changes, and future threat-intel feeds is advised to capture any new indicators that could clarify the campaign’s scope and attribution.