webmail-bell-one[.]vercel[.]app

Analysis of the domain webmail-bell-one.vercel.app indicates it was actively involved in a credential phishing campaign targeting users of a Canadian telecommunications provider. The domain was registered on February 21, 2026, through Tucows Domains Inc. and hosted on Vercel’s platform, resolving to the IP address 216.198.79.3 within Amazon.com, Inc.’s AS16509 network in the United States. The SSL certificate, issued by Google Trust Services under the WR1 intermediate, remains valid, though this does not mitigate the domain’s malicious intent. As of July 24, 2026, the domain returned an HTTP 451 status code, typically associated with legal restrictions or content unavailability, and displayed a 'Deployment Unavailable' page title. This suggests the phishing infrastructure was either voluntarily taken offline or disrupted by the hosting provider.

Detection engines on VirusTotal flagged the domain as malicious, with 15 of 93 security vendors marking it as a threat. Additionally, the domain appeared on one security blocklist, specifically PhishDestroy. Infrastructure analysis reveals the use of Vercel’s hosting services, a common tactic among threat actors due to the platform’s free tier and ease of deployment. The presence of HTTP Strict Transport Security (HSTS) headers further aligns with phishing campaigns seeking to appear legitimate by enforcing encrypted connections.

While the exact content of the phishing page remains unanalyzed, the domain’s classification as a credential phishing site is supported by its naming convention, which closely resembles a legitimate webmail portal. Defenders should treat this domain as compromised and ensure it is blocked at the network level. Organizations targeted by similar campaigns are advised to monitor for credential theft attempts and educate users on recognizing phishing domains hosted on legitimate cloud platforms.