grove-storm-rush[.]vercel[.]app

This domain, grove-storm-rush.vercel.app, operates as a credential-harvesting phishing site designed to deceive users into submitting login details. The infrastructure was configured to present fraudulent authentication portals, likely impersonating legitimate services to capture usernames, passwords, and other sensitive information. While the current page displays a 404 error, historical analysis confirms its use in active phishing campaigns prior to being taken offline. Analysis indicates the domain was registered on February 23, 2026, through Tucows Domains Inc., a common registrar for both legitimate and malicious domains. It is flagged by 10 out of 95 security vendors on VirusTotal, and appears on three security blocklists, including those maintained by cryptocurrency and web3 security platforms. The site resolved to IP address 64.29.17.3 and used a valid SSL certificate issued by Google Trust Services, a tactic frequently employed by threat actors to lend false legitimacy to phishing pages. If you visited grove-storm-rush.vercel.app or entered any information on a page hosted there, assume your credentials have been compromised. Immediately change passwords for any accounts accessed or entered on the site, especially financial or email accounts. Enable multi-factor authentication where available. Monitor accounts for unauthorized activity and report any suspicious transactions. Clear browser cache and cookies to remove any residual tracking elements. Avoid interacting with links or attachments from unexpected messages, even if they appear to come from known contacts.