test123123-three[.]vercel[.]app

Analysis of test123123-three.vercel.app shows a newly created domain (registered 21 February 2026 via a registrar) that is currently active and serving HTTP 200 responses. The site presents the page title "Пример" and employs HTTPS with a certificate issued by a public certificate authority. Infrastructure inspection reveals the domain is hosted on a cloud platform and resolves to IP address 64.29.17.3, an address allocated to a large cloud provider in the United States. The IP is associated with ASN 16509, indicating operation within a major cloud network. The domain appears on two security blocklists (PhishDestroy and ScamSniffer) and has a Gridinsoft trust score of 0/100, reinforcing the suspicion of malicious intent. VirusTotal scans report that 2 of 93 security vendors flagged the domain, providing limited but tangible detection evidence. While the exact payload or credential‑harvesting mechanisms have not been disclosed, the combination of blocklist presence, low trust score, and vendor detections justifies a high‑risk classification for generic phishing. Defenders should block the domain at perimeter filters, monitor DNS queries for the associated IP, and consider adding the domain to internal blacklists. Ongoing observation is advised to detect any future activity or payload delivery associated with this infrastructure.