zncu20ruhsd02hn-sn-cnoe3903ijnfew[.]vercel[.]app

PhishDestroy identifies zncu20ruhsd02hn-sn-cnoe3903ijnfew.vercel.app as an elevated-risk credential-harvesting domain actively luring victims into disclosing login credentials. The domain resolves to IP 64.29.17.131 and is currently hosted on Vercel Inc. infrastructure behind a Google Trust Services SSL certificate, indicating an attempt to appear legitimate while bypassing browser security warnings. This domain was flagged by 11 of 95 VirusTotal security vendors and is associated with a known seed hash a79e9e, confirming prior malicious activity. The hostname follows a randomized subdomain pattern typical of quick-turn phishing campaigns and has been detected delivering fake login prompts designed to steal user passwords and session tokens. The infrastructure shows no evidence of prior blocklisting but exhibits low trust scores across multiple threat intelligence feeds due to its recent creation and suspicious hosting patterns. To mitigate credential theft risks, immediately block zncu20ruhsd02hn-sn-cnoe3903ijnfew.vercel.app at network and DNS levels. Inspect all recent login attempts from users who accessed this domain for signs of account compromise. Train users to verify URLs before entering credentials and enable multi-factor authentication across all services. Report this domain to your security vendor and consider implementing browser-based phishing URL detection using the seed hash a79e9e to prevent future exposures.