casefb351893-zz12[.]vercel[.]app

Analysis of casefb351893-zz12.vercel.app shows that the domain was registered on 21 February 2026 through Tucows Domains Inc. and is hosted on Amazon’s AS16509 network, resolving to 216.198.79.131 in the United States. The site presents a Vercel‑hosted deployment that currently returns HTTP 451 with the page title “Deployment Unavailable”. The TLS certificate is issued by Google Trust Services under the WR1 label, indicating a valid certificate chain but offering no assurance of benign intent. The domain is listed on a single public blocklist and has been actively blocked by the PhishDestroy sinkhole.

VirusTotal records indicate that 16 of 93 scanned scanners flagged the host, and Google Safe Browsing classifies it as a social‑engineering threat. Detected technologies include Vercel and enforced HSTS, which are typical for legitimate services but also frequently abused by phishing operators to lend credibility. The combination of recent creation, rapid detection by multiple vendors, and the “Deployment Unavailable” placeholder page suggests the infrastructure was provisioned for malicious use and subsequently taken offline. At present, no content beyond the placeholder title has been captured, leaving the exact phishing payload or targeted brand undefined.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation of the same hostname or adjacent subdomains, and update threat‑intel feeds with the observed indicators: IP 216.198.79.131, ASN 16509, TLS fingerprint (Google Trust Services/WR1), and the HTTP 451 response. Because the site is already offline, incident response can focus on preventing reuse of the underlying Vercel project or similar throwaway deployments. Ongoing vigilance is recommended, especially for traffic that attempts to resolve the domain or its IP, as the actors may migrate to new hostnames while retaining the same hosting profile.