firstcitizensecure.vercel[.]app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of firstcitizensecure.vercel[.]app
The domain firstcitizensecure.vercel[.]app appears to present a banking login page branded as First Citizens Bank, with a page title of "Login" and a screenshot showing a "Secure Sign In" form. The content includes bank-style branding elements, FDIC-related wording, username and password fields, and support-style links such as "Forgot password?" and "Unlock account?". Based on the visible content, the page appears designed to resemble an online banking authentication portal.
The site is hosted on a Vercel subdomain rather than on the bank's primary domain. It also references an official-looking login.firstcitizens.com URL among its links, which may indicate an attempt to appear connected to the legitimate institution. Based on the domain structure, branding, and page layout, this page may be intended to imitate a financial-services login experience rather than operate as an independent banking service.
Safety Assessment for firstcitizensecure.vercel[.]app
This website was flagged by 19 out of 92 security engines at the time of this scan, and multiple web-classification providers categorized it as phishing, fraud-related, or malicious. The combination of a banking-themed login page, a third-party hosting subdomain, and broad multi-engine detection is a strong warning sign. The domain name closely resembles First Citizens branding and may be a look-alike page intended to capture account credentials from visitors who believe they are signing in to the real bank.
Although the malware file scan did not identify malicious files and the checked blacklist sources were clean at the time of this scan, those signals do not outweigh the phishing-related indicators. Credential-harvesting pages often contain minimal or clean-looking code while still posing risk through deceptive branding and login forms. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid TLS certificate issued by a mainstream certificate authority, with expiry listed as 2026-07-27. It is hosted on Vercel infrastructure, with the web server identified as Vercel and DNS pointing to vercel-dns nameservers. DNSSEC appears to be unsigned, which is common but provides no additional DNS integrity protection.
From a technical perspective, the main concern is not malware delivery but likely impersonation and credential collection. The page is served from a vercel.app subdomain rather than an official bank-owned domain, while visually presenting itself as a secure financial login page. That mismatch between branding and hosting context is a notable risk indicator at the time of this scan.
Share your experience with this website. Was it safe? Did you encounter any issues?