revocar-plan-mensual[.]vercel[.]app

revocar-plan-mensual.vercel.app was registered through Tucows Domains Inc. on February 21, 2026. DNS resolution points to the IPv4 address 216.198.79.3, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site served an HTTP 451 response and presented the page title “Deployment Unavailable”, indicating that the Vercel deployment was taken offline. TLS termination is provided by a Google Trust Services certificate issued to the WR1 entity, and the service enforces HTTP Strict Transport Security (HSTS).

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy filtering service. VirusTotal analysis shows that 13 of 93 scanned security vendors flagged the domain as malicious, reinforcing the phishing assessment. No additional public intelligence such as Safe Browsing or Open Threat Exchange entries was observed. The limited data set leaves the exact phishing campaign details, target brand, and lure content unknown.

Nonetheless, the combination of a recent registration, Amazon‑hosted infrastructure, Vercel technology, a valid Google‑issued TLS certificate, and multiple vendor detections constitutes a high‑confidence indicator of a phishing‑related operation. Defensive recommendations include adding the domain and its resolving IP address to URL and IP allow‑/deny lists, ensuring that endpoint browsers enforce strict HSTS policies, and monitoring for any re‑activation of the Vercel deployment. Continuous re‑scanning with multi‑vendor services is advised to capture any changes in the threat posture.