verication-casefb973992[.]vercel[.]app

PhishDestroy identifies verication-casefb973992.vercel.app as a live crypto credential theft site posing as a verification portal. The domain leverages Vercel’s hosting infrastructure to deliver a convincing fake login flow, tricking users into surrendering wallet or exchange credentials. The elevated risk stems from its current active status, clear intent to harvest authentication details, and presence across multiple security vendor blocklists. Immediate intervention is required to prevent account takeovers or fund drainers embedded in subsequent steps.

This domain resolves to IP address 216.198.79.195 and is registered through Vercel Inc., a legitimate PaaS provider commonly abused for short-lived malicious campaigns. VirusTotal analysis reveals 3 security vendors flagging the host among 95 tested, indicating moderate but concerning detection coverage. The SSL certificate is issued by Google Trust Services, lending superficial legitimacy to the phishing page. Intelligence shows the domain was created recently and has already appeared on proprietary blocklists, confirming its malicious lifecycle is in early operational stages.

To mitigate exposure, SOC teams should block 216.198.79.195 and the domain at network and DNS layers. Users must be warned against entering credentials or wallet seeds on any page linked from unsolicited messages, even when served over HTTPS. Implement browser policies to strip known TLDs from suspicious subdomains under vercel.app that contain high-entropy strings like casefb973992. Continuous monitoring of newly registered subdomains under vercel.app is advised, with immediate containment for any hosting crypto-themed lures.