Is vercel.app legit or a scam?
Vercel.app is the official deployment subdomain for Vercel Inc., a legitimate 2015-founded developer platform trusted by MT Intelligence and Meta.
Analysis Summary
No threats detected
All checks passed. This site appears legitimate — but always stay alert for phishing even on trusted domains.
Website Preview
Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site. See full visual analysis →
MT Intelligence
Vercel Inc. is a well-documented, active US company founded in 2015 with 550–1000 employees and major enterprise customers. The vercel.app domain is the primary deployment platform for the service, registered in January 2020 and set to expire in 2036. Our antivirus network shows one detection from a single engine (Chong Lua Dao) flagged as malicious, but this is an outlier against 91 clean engines and no browser blocklist hits. The SSL certificate is valid and issued by Google Trust Services. The page content matches Vercel's official branding and marketing messaging. While the evidence package documents multiple phishing and fraud cases where attackers have hosted malicious sites on random *.vercel.app subdomains (e.g., samabaghdad-iq.vercel.app, fastpaydm.vercel.app), those are third-party deployments by bad actors, not the root domain itself. Vercel actively maintains an abuse-reporting system and takes down malicious deployments. The root vercel.app domain shows no evidence of compromise or misuse.
Web Research Findings
Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for vercel.app, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.
- vercel.app is the primary deployment platform and subdomain for Vercel Inc (vercel.com), a well-known legitimate US company founded in 2015 that provides frontend hosting, Next.js framework, and AI development tools.
- Domain registered January 2020, expires 2036, registrar Tucows; company has hundreds of employees and major customers including OpenAI.
- Vercel maintains an official abuse reporting form (vercel.com/abuse) specifically because cybercriminals frequently host phishing, malware, and impersonation sites (e.g. fake financial services, OpenSea, PDF viewers) on random *.vercel.app
- Multiple documented cases of phishing campaigns and fraud using subdomains such as samabaghdad-iq.vercel.app (scammed $5000), fastpaydm.vercel.app (credential theft), opensea-*.vercel.app, and others impersonating Adobe, Meta, etc.
- The scanned page title and description exactly match Vercel's official branding; no evidence this specific root domain or the provided page is malicious.
- ScamAdviser page for vercel.app notes it redirects to vercel.com; no dedicated negative trust score found. Trustpilot and similar sites review vercel.com positively overall with some support complaints.
- Frequent Reddit and community reports confirm attackers abuse the platform due to its ease of deployment, but Vercel actively responds to abuse reports by taking down malicious deployments.
- Vercel Communityopen
"I have been reporting The fraudulent website "https://samabaghdad-iq.vercel.app" for several months now that has scammed me out of $5,000. This fraudulent site impersonates the legitimate company “Sama Baghdad Financial Services”"
- CyberArmoropen
"Cybercriminals sent phishing emails containing a link that directed recipients to a malicious page hosted on Vercel, a legitimate website hosting platform. Upon visiting the page, it impersonated an Adobe PDF viewer"
- GitHub Vercel Communityopen
"Fraud website [fastpaydm.vercel.app] ... misused by irresponsible parties by taking user data, pins, keys when entering data on the website."
- Vercel Communityopen
"I can confirm that this is a scam. URL: https://opensea-opengifts27.vercel.app/ ... https://mintfast-opensea6.vercel.app/"
- Wikipediaopen
"Vercel Inc. is an American cloud application company. The company created and maintains the Next.js web development framework."
- Vercel Aboutopen
"At Vercel, our mission is to enable developers to build and publish wonderful, high-performant apps and websites."
- Contrary Researchopen
"Vercel is a cloud-based platform for building, previewing, and deploying front-end web applications. Founded in 2015"
Vercel Inc., founded 2015 (formerly ZEIT), headquartered in San Francisco, CEO Guillermo Rauch, ~550-1000 employees, maintains Next.js framework. Trusted by OpenAI, Meta and others.
Our research found that Vercel Inc. is a legitimate US company founded in 2015, headquartered in San Francisco, with 550–1000 employees and major customers including MT Intelligence and Meta. The company maintains the Next.js web framework and provides cloud infrastructure for frontend deployment.
The evidence package documents multiple phishing and fraud cases where attackers have hosted malicious sites on random *.vercel.app subdomains—including samabaghdad-iq.vercel.app (which scammed a user out of $5,000), fastpaydm.vercel.app (credential theft), and opensea-*.vercel.app (impersonating OpenSea). These are third-party deployments by bad actors exploiting Vercel's ease of deployment, not compromises of the root domain itself.
Vercel actively responds to abuse reports and maintains a dedicated abuse-reporting form (vercel.com/abuse) to combat this misuse. The root vercel.app domain shows no evidence of compromise or malicious operation.
Antivirus Engines
Security Scans
Checked against the major public blocklists used by browsers and security tools — no hits.
Contact Verification
We fetched the page and looked for real-world contact details. Legitimate businesses almost always publish an email on their own domain, a phone number, and a postal address. Scam shops usually don't.
- No contact email found anywhere on the page.
- No postal address visible on the page.
- Page impersonates OpenAI / ChatGPT on a non-official domain.
- Phone number listed (0.0986328).
- Links to 4 social profiles.
Domain & Encryption
Redirect Chain
- 1308http://vercel.app/
- 2308https://vercel.app/
- 3200https://vercel.com/cross-domain
Server Reputation
Still, stay alert
No major threat indicators — but a clean scan does not guarantee every page is safe, and phishing emails routinely spoof real domains.
- Double-check the exact URL in your address bar
Confirm you are actually on vercel.app and not a lookalike like v-ercel.app.com or an IDN homoglyph.
- Use a password manager
Password managers only auto-fill on the exact domain they were saved for — they refuse to fill lookalike domains, which is the single best phishing defence.
- OpenDiscuss this site on the forum
If you have first-hand experience with this site — good or bad — share it with the MalwareTips community.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
Safety FAQ
Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.
- Our automated security review found no threat indicators on vercel.app. The site appears legitimate based on the signals we checked, but always stay alert for phishing emails that spoof real domains.
- vercel.app passed our automated security checks with a trust score of 85/100. No antivirus engines or major blacklists flagged the site at the time of the last scan.
- Yes. vercel.app presents a valid TLSv1.3 certificate issued by Google Trust Services · WR1, expiring in 46 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
- vercel.app is 6.4 years old, registered on 1/27/2020 through Tucows Domains Inc. Scam domains are often freshly registered — a site under 6 months old warrants extra caution.
- 1 out of 92 antivirus engines in our malware network flagged vercel.app as malicious or suspicious (1 outright malicious). Even one detection is a meaningful signal.
- No. vercel.app is not currently listed on the major browser blocklist feeds that modern browsers use.
- vercel.app resolves to an IP operated by Vercel, Inc in US (usage type: Content Delivery Network). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
- Yes. vercel.app sits in the global top-100k on Cloudflare Radar, which means it has substantial real-world traffic. That does not automatically make it safe, but established brands almost always rank here and throwaway scam domains almost never do.
User reviews & comments(0)
Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.