trx-fee-2[.]vercel[.]app

trx-fee-2.vercel.app is listed on a security blocklist and has been flagged by PhishDestroy as a malicious site. The domain is a sub‑domain of vercel.app, a public cloud‑hosting service that can be used for rapid deployment of malicious pages. According to the provided intelligence the domain appears on one blocklist and its status is marked as active, with the risk level noted as under investigation.

No additional public intel such as SSL certificates, page‑title information, or external scanning results is currently available, so the full scope of the payload or credential‑harvesting technique cannot be confirmed. The lack of further evidence means that defenders cannot yet identify the specific phishing campaign or targeted brand, but the presence on a reputable blocklist indicates a non‑trivial threat. Recommended defensive actions include adding trx‑fee‑2.vercel.app to DNS‑based deny lists, configuring proxy or firewall rules to block HTTP/HTTPS requests to the domain, and enabling real‑time URL filtering in web gateways.

Network monitoring should look for outbound connections to the IP address that resolves the sub‑domain, and any authentication attempts that coincide with traffic to this host should be investigated for possible credential compromise. Security teams should also watch for newly registered sub‑domains under vercel.app that exhibit similar characteristics, as threat actors often rotate such infrastructure. Because the domain is still under investigation, continuous intelligence gathering and periodic re‑assessment are advised to update detection signatures as more data become available.