sbbin[.]vercel[.]app

This domain, sbbin.vercel.app, is confirmed to operate as a credential harvesting phishing site designed to deceive users into submitting sensitive login information. Analysis indicates the site employs social engineering tactics, such as mimicking legitimate login portals, to capture usernames, passwords, and other authentication details. The infrastructure is optimized for rapid deployment and takedown, a common characteristic of phishing campaigns aiming to evade detection while maximizing victim engagement. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain is flagged by 20 out of 95 security vendors on VirusTotal, with detections spanning heuristic analysis and behavioral signatures. It appears on two independent security blocklists, further corroborating its malicious intent. The domain is registered through Vercel Inc., a platform frequently exploited for hosting transient phishing pages due to its ease of deployment and ephemeral nature. DNS resolution points to the IP address 64.29.17.3, geolocated within the United States under AS16509, an autonomous system associated with cloud infrastructure commonly leveraged for malicious activities. The SSL certificate, issued by Google Trust Services (WR1), provides a veneer of legitimacy while failing to mitigate the underlying threat. Users who accessed sbbin.vercel.app should immediately take corrective actions to mitigate potential compromise. First, revoke any credentials entered on the site, particularly those associated with financial, corporate, or personal accounts. Enable multi-factor authentication (MFA) on all critical services to prevent unauthorized access. Monitor accounts for suspicious activity, such as unrecognized transactions or login attempts, and report any anomalies to the respective service providers. If corporate credentials were exposed, notify internal security teams to initiate incident response protocols. Given the elevated risk level, affected users should also consider scanning their devices for malware or unauthorized modifications, as phishing sites may deploy additional payloads to maintain persistence.