gbel[.]vercel[.]app

The domain gbel.vercel.app was created on January 28, 2020 and is registered through Tucows Domains Inc. Technical probes reveal that the site resolves to IP address 64.29.17.3, which belongs to Amazon.com, Inc. (AS16509) and is physically located in the United States. The hosting environment is identified as Vercel, and the HTTP response returned a 451 status code, indicating that the resource is unavailable for legal reasons. The page title presented at the time of analysis was "Deployment Unavailable," and the SSL certificate in use is issued by Google Trust Services under the WR1 label, confirming that TLS is correctly configured but offering no assurance of legitimacy.

The domain employs HTTP Strict Transport Security (HSTS) and is served by the nameservers ns1.vercel-dns-3.com, ns2.vercel-dns-3.com, ns3.vercel-dns-3.com, and ns4.vercel-dns-3.com. Reputation data shows that the domain appears on at least one security blocklist, specifically PhishDestroy, and VirusTotal reports 15 detections out of 93 scanned security vendors, indicating a notable level of suspicion across multiple scanning engines. No further public intelligence, such as Safe Browsing or OTX entries, is available beyond the listed observations.

The current operational status is offline, suggesting that the phishing infrastructure may have been taken down or is temporarily inactive. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑activation, and incorporate the observed indicators—IP address, SSL issuer, Vercel hosting fingerprint, and the 451 response—into threat‑intel feeds. Ongoing vigilance is advised, especially given the presence on a dedicated phishing blocklist and the multi‑vendor detection record, which together imply that the domain was previously leveraged for malicious credential‑harvesting or related phishing campaigns.