userchangeaddress[.]vercel[.]app

The domain userchangeaddress.vercel.app is actively engaged in credential phishing, targeting unsuspecting users. Despite a cloaking score of 1/10, indicating it serves benign content to scanners, it is flagged as malicious by 5 out of 95 vendors on VirusTotal. This discrepancy highlights the site's sophisticated evasion tactics, making it a significant threat.

Registered under Vercel Inc., the domain operates from an IP hosted in the United States by Vercel, Inc. The SSL certificate is issued by Google Trust Services, adding a layer of legitimacy to deceive users. The platform risk score is alarmingly high at 98/100, underscoring the potential danger it poses to users who might inadvertently provide sensitive information.

PhishDestroy's early detection of this domain on April 13, 2026, emphasizes the importance of identifying threats before they are widely recognized by antivirus vendors. With only one public blocklist entry, the domain exploits the critical window between registration and AV database propagation to conduct its phishing operations effectively. This case illustrates the need for continuous monitoring and rapid response to emerging threats.