uk6u-casefb945908[.]vercel[.]app

The domain uk6u-casefb945908.vercel.app was registered on 2026-02-21 through Tucows Domains Inc. It resolves to the IPv4 address 216.198.79.3, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The hosting platform is identified as Vercel and the TLS certificate is issued by Google Trust Services under the WR1 label, indicating a valid HTTPS configuration with HSTS enabled. An HTTP request to the root returned status code 451 and the page title “Deployment Unavailable”, confirming that the service is currently taken offline. VirusTotal analysis shows that 14 of 93 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of abuse.

The domain appears on a single external blocklist, PhishDestroy, which has actively blocked it. The combination of a recent registration, cloud‑hosted infrastructure, a valid SSL certificate, and multiple vendor detections aligns with typical patterns of short‑lived phishing deployments that use reputable hosting to evade reputation checks. Because the site is presently offline, active exploitation cannot be observed, but the historical evidence suggests it was used for a generic phishing campaign.

Defenders should continue to block the domain at perimeter firewalls, proxy filters, and DNS sinks, and update any threat‑intelligence feeds with the indicator set {uk6u-casefb945908.vercel.app, 216.198.79.3}. Monitoring for re‑registration or similar sub‑domain patterns on Vercel is recommended, as threat actors frequently recycle the same hosting provider. The lack of additional context such as payload or target brand limits attribution, so further investigation should focus on network traffic captures that contain the domain or its IP address.