bellenbusiness[.]vercel[.]app

PhishDestroy identifies an active credential theft campaign hosted at bellenbusiness.vercel.app, posing as a legitimate business portal to harvest user login details. The domain is weaponized to deceive victims into surrendering sensitive credentials under the guise of a professional service interface. This operation exploits trust in well-known platforms by abusing the Vercel Inc. hosting infrastructure to deliver a convincing but malicious login flow. This domain was flagged by 7 out of 95 security vendors on VirusTotal and is resolving to IP address 216.198.79.67. It is registered through Vercel Inc. and leverages a Google Trust Services SSL certificate to appear legitimate. The presence of a valid SSL certificate enhances its credibility and reduces user suspicion during credential submission. To mitigate this threat, organizations should immediately block traffic to IP 216.198.79.67 and the domain bellenbusiness.vercel.app at the network perimeter. Users should be warned not to enter credentials on unverified domains, even those with valid SSL certificates. Additionally, enable multi-factor authentication across all business-critical services to limit the impact of credential theft. Threat hunting efforts should search for POST requests to this domain in proxy and DNS logs, as well as any failed login attempts following access to this site.