router-gateway-nu[.]vercel[.]app

router-gateway-nu.vercel.app is presently recorded on a single security blocklist and has been blocked by PhishDestroy, which classifies it under the generic phishing category. The domain’s suffix (.vercel.app) indicates it is hosted on the Vercel cloud‑hosting service, a platform frequently leveraged for rapid deployment of web applications, including short‑lived malicious payloads. No further attributes such as registrar information, IP address, autonomous system number, geographic location, SSL certificate details, Safe Browsing verdicts, or Open Threat Exchange entries are included in the supplied intelligence, leaving those aspects unverified.

The threat record lists the risk level as "under investigation" while retaining an active operational status, suggesting that the domain continues to resolve and serve content despite limited public reporting. Because the only concrete indicator is the blocklist entry from PhishDestroy, defensive teams should treat the domain as hostile until additional analysis either confirms benign behavior or provides more granular indicators of compromise. Recommended mitigation actions include inserting the fully qualified domain name into DNS‑based sinkhole or block policies, enforcing outbound URL filtering rules that deny HTTP/S connections to the host, and configuring endpoint detection and response solutions to generate alerts on any resolution or connection attempts to the domain.

Continuous monitoring of threat‑intel feeds for new blocklist entries, sandbox reports, or reputation changes is advisable, as is periodic re‑assessment of the domain’s status should further evidence emerge. In the absence of contradictory data, the domain should be regarded as a high‑confidence malicious indicator and blocked at both network perimeter and host levels.