revocar-plan-mensual-cardif[.]vercel[.]app

This domain, revocar-plan-mensual-cardif.vercel.app, is assessed as a confirmed phishing site targeting Cardif insurance customers, based on infrastructure analysis and available detection data. Registered on February 21, 2026, through Tucows Domains Inc., the domain resolved to IP 64.29.17.67, hosted on Amazon.com, Inc. (AS16509) infrastructure in the US. As of July 23, 2026, the domain is offline, returning an HTTP 404 status with the page title '404: NOT_FOUND'. The domain appears on one security blocklist (PhishDestroy) and is flagged by 14 of 93 security vendors on VirusTotal, indicating broad detection despite its current inactive state.

The SSL certificate, issued by Google Trust Services (WR1), and the use of Vercel hosting with HSTS enforcement suggest an attempt to appear legitimate, though these technologies are frequently abused in phishing campaigns. The domain name itself includes 'cardif', strongly implying an intent to deceive users of Cardif insurance services, likely through fraudulent policy cancellation or account verification schemes. While the exact content of the phishing page is not available for analysis, the combination of brand-specific naming, hosting on a common phishing platform (Vercel), and security vendor detections provides sufficient evidence to classify this as a confirmed phishing threat. Defenders should treat this domain as malicious and ensure it is blocked at DNS, proxy, and endpoint levels.

Given its offline status, monitoring for reactivation or similar domains using the same infrastructure (e.g., Vercel, Amazon AS16509) is recommended. If logs or network traffic indicate user interaction with this domain, initiate incident response procedures, including credential resets and account audits for affected users. No further brand-specific details about the phishing kit or user interaction flow are available at this time.