cbblast[.]vercel[.]app

Analysis indicates that the domain cbblast.vercel.app is currently active and classified as a high‑risk brand‑impersonation site targeting the Blast brand. The domain was created on 26 July 2025 and resolves to the IP address 64.29.17.131, which belongs to Amazon.com, Inc. (AS16509) in the United States. Hosting is provided through Vercel, as reflected by the Vercel‑issued nameservers (ns1.vercel‑dns.com, ns2.vercel‑dns.com) and the presence of the React framework and HSTS header in the HTTP response. The TLS certificate is issued by Google Trust Services under the WR1 label, confirming the use of a valid HTTPS connection.

Multiple security services have flagged the domain. Google Safe Browsing lists it under the “SOCIAL_ENGINEERING” category, and VirusTotal reports that 15 of 95 scanned security vendors have marked the site as malicious. The domain appears on one public blocklist and has been actively blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment.

Publicly available information does not include a detailed page walkthrough; the only observed page title is “React App,” and no specific login or credential‑collection page has been captured. Consequently, the exact phishing payload or credential‑stealing mechanisms remain unknown, although the combination of brand impersonation, high‑risk rating, and multiple vendor detections strongly suggests a credential‑harvesting intent.

Defenders should block cbblast.vercel.app at network perimeter and endpoint URL filtering solutions, and add the domain to internal threat intelligence feeds. Continuous monitoring of DNS queries for the associated IP address and Vercel host patterns is advised, as the infrastructure can be rapidly replicated. User awareness campaigns should highlight the risk of unsolicited communications purporting to originate from Blast and instruct users to verify URLs before entering credentials.