usbankreplica[.]vercel[.]app

This domain, usbankreplica.vercel.app, is actively flagged as a high-risk phishing site targeting US Bank customers. Analysis indicates the page title explicitly mimics the legitimate US Bank portal, displaying 'US Bank - Personal Banking, Credit Cards & Loans,' a clear indicator of brand impersonation. The domain is hosted on Vercel infrastructure and resolves to IP address 216.198.79.131. Security vendors have detected malicious activity, with 19 of 95 engines on VirusTotal identifying the domain as malicious. Google Safe Browsing classifies the site under 'SOCIAL_ENGINEERING,' further confirming its fraudulent intent. The SSL certificate is issued by Google Trust Services, which, while legitimate, is commonly exploited by threat actors to lend false credibility to phishing pages. Infrastructure analysis reveals the domain is registered through Vercel Inc., a platform frequently abused for hosting phishing content due to its ease of deployment and free hosting services. The presence of HSTS (HTTP Strict Transport Security) does not mitigate the threat, as it is automatically applied by Vercel and does not indicate legitimate use. The domain appears on at least one security blocklist and is currently blocked by PhishDestroy. No evidence suggests takedown or remediation efforts have been successful as of July 12, 2026. Defenders should treat this domain as an active threat. Network-level blocking of the domain and its resolving IP (216.198.79.131) is recommended. Organizations should monitor for credential submissions or redirects to this domain and alert users who may have interacted with it. Further analysis of the site's backend or payload is pending, but the available indicators confirm its classification as a banking phishing operation.