backupss[.]vercel[.]app

This domain, backupss.vercel.app, was registered on 21 February 2026 through Tucows Domains Inc. and is hosted on a Vercel platform that enforces HTTP Strict Transport Security. The site resolves to IP 216.198.79.195, an address owned by Amazon.com, Inc. (AS16509) located in the United States. TLS negotiation presents a certificate issued by Google Trust Services under the WR1 intermediate, confirming a valid HTTPS endpoint. An HTTP request to the root URL returns status code 451, indicating the content is unavailable for legal reasons, and the page title returned by the server is “W3BFIXING”.

The domain is currently taken offline, but historical observations show it was actively used in a delivery‑scam campaign. The domain appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—and has been flagged by 11 of 93 security vendors on VirusTotal, reflecting a moderate level of detection consensus. No additional intelligence such as payload samples, phishing kit identifiers, or victim reports has been released, leaving the exact content and victim interaction unknown.

Defenders should immediately block network traffic to both the domain and its resolved IP address, enforce URL filtering for the Vercel host, and monitor for any residual artifacts that reference the “W3BFIXING” title. Continuous re‑scanning of the domain on multi‑engine services is advised in case the site is re‑hosted, and threat‑intel feeds should be updated to include the observed blocklist identifiers. In the absence of further forensic detail, the primary mitigation focus remains on containment of the identified infrastructure and vigilance for related delivery‑scam indicators.