easybank-landing-page-nu[.]vercel[.]app

Analysis of the domain easybank-landing-page-nu.vercel.app indicates an active high-risk banking phishing campaign as of July 24, 2026. The domain resolves to IP address 216.198.79.67, hosted on Amazon.com, Inc. infrastructure (AS16509) located in the United States. Registered through Vercel Inc. on July 3, 2025, the domain remains operational with an HTTP 200 status, suggesting the phishing page is actively serving content. The page title, 'Frontend Mentor | Easybank landing page,' implies an attempt to mimic a legitimate Easybank interface, though the exact content and functionality of the site have not yet been fully analyzed.

Infrastructure analysis reveals the use of Vercel hosting services and HTTP Strict Transport Security (HSTS), alongside an SSL certificate issued by Google Trust Services (WR1). Despite these security measures, the domain appears on one security blocklist (PhishDestroy) and is flagged by 19 of 95 security vendors on VirusTotal, confirming its malicious classification. Trust scores from Scamadviser and Gridinsoft further support this assessment, with both assigning a score of 1/100 and 0/100, respectively.

Defenders should prioritize blocking access to this domain and its associated IP address within enterprise and consumer security tools. Given the domain's registration under Vercel Inc. and its hosting on a widely used cloud provider, monitoring for similar patterns—such as newly registered Vercel subdomains with banking-related keywords—may aid in detecting related phishing infrastructure. The campaign's continued activity underscores the need for real-time threat intelligence integration to mitigate exposure.