compound-finances[.]vercel[.]app

This domain, compound-finances.vercel.app, is confirmed as an active brand impersonation phishing site targeting Compound Finance. Analysis indicates the site mimics the legitimate Compound platform, likely to deceive users into disclosing sensitive credentials or transferring cryptocurrency assets. The domain remains operational as of the latest verification, posing an ongoing risk to unsuspecting visitors. Infrastructure analysis reveals the domain was registered on March 03, 2026, through Vercel Inc., and resolves to the IP address 64.29.17.131, hosted on Amazon.com, Inc. infrastructure (AS16509). The page title, "Compound Finance — Earn Interest," directly mirrors the branding of the legitimate Compound platform. Detection metrics show the domain is flagged by 1 of 95 security vendors on VirusTotal, while appearing on 3 independent security blocklists. The SSL certificate is issued by Google Trust Services (WR1), a common tactic to lend false legitimacy to malicious sites. Additional intelligence confirms the domain is blocked by multiple security entities, including PhishDestroy, MetaMask, and SEAL. Current status indicates the domain remains active, with no takedown or mitigation measures observed. The high-risk classification stems from its direct impersonation of a major decentralized finance platform, combined with its presence on multiple blocklists and low detection rates on aggregate scanning platforms. Recommended actions include immediate blacklisting of the domain and IP address within organizational security controls, deployment of network-level blocking rules, and user education to recognize brand impersonation tactics. Security teams should monitor for related domains registered under Vercel Inc. or resolving to the same IP range, as threat actors frequently reuse infrastructure for subsequent campaigns.