operativo-khaki[.]vercel[.]app

This domain is currently under investigation for hosting a generic phishing site designed to impersonate a tactical apparel retailer. The page title, 'OPERATIVO — Linha Tática de Camisetas,' suggests an attempt to mimic legitimate e-commerce platforms specializing in military-style clothing, potentially targeting consumers with fraudulent checkout processes or credential harvesting mechanisms. Analysis indicates the threat type is not a crypto drainer or fake login portal but rather a brand impersonation scheme aimed at financial fraud or data exfiltration through fake transactions. Infrastructure analysis reveals the following technical indicators: the domain operativo-khaki.vercel.app was created on April 21, 2026, and is registered through Vercel Inc. It resolves to the IP address 216.198.79.131, located in the United States and associated with Vercel's hosting infrastructure. The SSL certificate is issued by Google Trust Services (WR1), a common provider for legitimate and malicious domains alike. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating no prior flagging by security vendors. However, the domain appears on one security blocklist, specifically PhishDestroy, suggesting preliminary detection by at least one threat intelligence source. The domain remains active, with no signs of takedown or mitigation at the registrar or hosting level. Mitigation steps for this threat type should focus on disrupting the fraudulent transaction pipeline. Network-level blocking of the domain and its resolving IP (216.198.79.131) is recommended for enterprise environments, particularly in retail, e-commerce, and financial sectors. Endpoint protection systems should be configured to flag or quarantine any outbound connections to operativo-khaki.vercel.app, with particular attention to POST requests that may indicate form submission or payment processing. Organizations should also monitor for SSL certificates issued by Google Trust Services (WR1) tied to newly registered Vercel domains, as this combination has been observed in similar phishing campaigns. For consumers, verification of the domain's legitimacy through independent brand channels is advised before engaging with any checkout or payment processes. Given the domain's recent creation date and lack of prior detections, proactive monitoring for related infrastructure (e.g., subdomains, associated IPs) is warranted to identify potential lateral movement or campaign expansion.