win-flax[.]vercel[.]app

This domain, win-flax.vercel.app, is an active credential theft operation impersonating Bell Business to harvest corporate login credentials. The site mimics legitimate Bell Business portals, presenting a convincing facade to deceive employees or business customers into entering sensitive authentication details. Analysis indicates the threat actor has tailored the phishing kit to target enterprise users, increasing the likelihood of successful compromise for financial fraud or corporate espionage. The use of a reputable brand amplifies the risk, as victims are more likely to trust the interface and divulge credentials without suspicion. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 06, 2026, through Vercel Inc., an atypical registrar for business authentication portals. It resolves to IP address 64.29.17.195 under AS16509 (Amazon.com, Inc.), a common host for phishing infrastructure. The SSL certificate, issued by Google Trust Services (WR1), provides a false sense of security while failing to mitigate the underlying threat. Security vendors have flagged the domain in 21 out of 95 VirusTotal scans, and it appears on one security blocklist, confirming its malicious classification. The page title, 'Bell Business Site,' directly correlates with the impersonated brand, further validating the credential theft intent. Users who have visited win-flax.vercel.app or entered credentials on the site should take immediate remedial action. First, revoke any submitted credentials by changing passwords for Bell Business accounts and any other services where identical credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor account activity for suspicious transactions or login attempts, particularly those originating from unfamiliar locations or devices. Organizations should conduct a thorough review of network logs for connections to 64.29.17.195 or the domain itself, as these may indicate compromised endpoints. If corporate credentials were exposed, initiate an internal security incident response to assess potential lateral movement or data exfiltration. Given the high-risk classification and active status of this threat, proactive measures are essential to mitigate further damage.