coreumdesktop[.]app

The domain coreumdesktop.app is identified as a phishing site specifically impersonating Vercel security checkpoints. Analysis confirms this domain was designed to deceive users into believing they are interacting with legitimate Vercel authentication or verification processes. As of the latest assessment, the domain has been taken offline, though prior activity and infrastructure remain relevant for threat intelligence purposes. Technical indicators reveal coreumdesktop.app was flagged by 14 of 95 security vendors on VirusTotal, reflecting broad detection consensus. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 26, 2026, and resolved to the IP address 64.29.17.65. It appears on one security blocklist, and Gridinsoft assigned it a trust score of 0 out of 100. The SSL certificate was issued by Let’s Encrypt, and the site was hosted on Vercel infrastructure, which is consistent with the observed page title 'Vercel Security Checkpoint.' The domain was blocked by PhishDestroy prior to being taken offline. While coreumdesktop.app is no longer active, its infrastructure and registration details warrant continued monitoring. Organizations should ensure this domain is added to blocklists and web filtering systems to prevent potential re-emergence or similar threats. Users who may have interacted with the site should verify account integrity, reset credentials, and review connected services for unauthorized access. Security teams are advised to analyze logs for connections to 64.29.17.65 or requests to coreumdesktop.app, particularly in contexts involving Vercel or cloud service authentication workflows.