6465[.]vercel[.]app

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

This domain, 6465.vercel.app, is currently active and classified as a generic phishing threat with a high-risk assessment. Analysis confirms it impersonates SFR Mail, a French telecommunications provider, presenting a fraudulent webmail interface titled 'SFR Mail – Retrouvez votre Webmail, boite mail et adresse mail' to deceive users into submitting login credentials. The domain remains operational and poses a direct risk to individuals associated with SFR or its services. Infrastructure analysis reveals the domain is hosted on IP address 64.29.17.67, geolocated in the United States under Amazon.com, Inc. (AS16509). The SSL certificate is issued by Google Trust Services (WR1), a common characteristic of legitimate services that may lend false credibility to the phishing site. The domain is registered through Vercel Inc. and appears on one security blocklist. VirusTotal detection metrics show 19 of 95 security vendors flagging the domain as malicious, indicating a moderate-to-high confidence level in its phishing classification. No historical registration data or creation date is provided, but the use of Vercel’s platform suggests recent deployment, likely within the last 30 days. Current status indicates the domain remains active and unmitigated, continuing to host the phishing content. Organizations and end-users are advised to block the domain at the DNS or proxy level and add the IP address 64.29.17.67 to network deny lists. Security teams should monitor for credential submission attempts or connections to this endpoint, particularly from corporate or personal devices associated with SFR services. Users who may have interacted with the site should immediately reset passwords for SFR accounts and enable multi-factor authentication where available. No legitimate SFR webmail services are hosted on Vercel or resolve to this IP range.