mugbell[.]vercel[.]app

This domain, mugbell.vercel.app, is flagged for credential harvesting phishing activity targeting business users, classified under an elevated risk level. The threat specifically impersonates corporate login portals, as evidenced by the page title 'Bell Business Site,' designed to deceive users into submitting sensitive authentication credentials. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain resolves to IP address 216.198.79.195, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. It is registered through Vercel Inc. and secured with an SSL certificate issued by Google Trust Services (WR1). Security vendors have detected malicious activity, with 20 out of 95 engines on VirusTotal flagging the domain. Additionally, the domain appears on two security blocklists and is actively blocked by PhishDestroy and PhishingDB, reinforcing its classification as a confirmed phishing resource. Mitigation measures should prioritize immediate containment and user awareness. Organizations should ensure that endpoint protection systems are updated to recognize and block this domain and its associated IP address. Network-level filtering should be implemented to prevent resolution or connection attempts to 216.198.79.195. Security teams are advised to conduct retrospective log analysis to identify any prior interactions with the domain, particularly focusing on authentication attempts or credential submissions. User education campaigns should emphasize the risks of credential harvesting phishing, highlighting the use of impersonated business portals and the importance of verifying domain authenticity before entering sensitive information.