v2-riverdesktop[.]app

This domain, v2-riverdesktop.app, is actively hosting a phishing page impersonating Vercel's security verification process. Analysis indicates the threat type is brand impersonation, specifically mimicking Vercel's authentication or security checkpoint interface. The page title, 'Vercel Security Checkpoint,' suggests an attempt to deceive users into believing they are interacting with a legitimate security validation mechanism, likely targeting developers or users of Vercel-hosted services. No direct evidence of a crypto drainer or credential-harvesting kit was observed, but the infrastructure aligns with common phishing tactics used to capture sensitive account details. Infrastructure analysis reveals the following technical indicators: the domain was registered on April 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 76.76.21.21, a shared hosting environment often leveraged for phishing campaigns. The SSL certificate is issued by Let's Encrypt, providing a false sense of security to potential victims. VirusTotal detection metrics show 8 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists and is actively blocked by PhishDestroy and OISD. Technologies detected on the page include Vercel, which is consistent with the impersonated brand but does not confirm legitimate affiliation. The domain remains active and poses an elevated risk to users who may mistake it for an official Vercel security prompt. Response actions by security providers include blocklisting and flagging in threat intelligence feeds, but the domain continues to resolve and host malicious content. Users are advised to avoid interaction with the site and verify the authenticity of any security checkpoints by cross-referencing official domain listings. Organizations should update endpoint protection rules to block this domain and its associated IP address. Given the domain's recent registration and active status, further monitoring is warranted to track potential shifts in infrastructure or additional phishing pages hosted under the same registrar.