echo-web-chi[.]vercel[.]app

This domain, echo-web-chi.vercel.app, is identified as an active credential harvesting phishing site. Analysis indicates it is currently operational and designed to deceive users into submitting sensitive authentication details, likely through impersonation of legitimate services. No specific brand impersonation has been confirmed, but the generic phishing infrastructure suggests broad targeting of login credentials. Infrastructure analysis reveals the domain was registered through Vercel Inc. on June 12, 2026, and resolves to the IP address 216.198.79.67. It is flagged by 3 of 95 security vendors on VirusTotal and appears on three independent security blocklists. The SSL certificate is issued by Google Trust Services under the WR1 intermediate, a common practice among both legitimate and malicious domains. Detection engines such as PhishDestroy, MetaMask, and SEAL have already classified this domain as malicious, reflecting its confirmed use in phishing campaigns. The domain remains active as of the latest verification, posing a continued risk to users. Organizations and individuals are advised to block the domain and its resolving IP at the network perimeter. Endpoint protection systems should be updated to include this indicator of compromise. Users who may have interacted with the site should reset credentials immediately, enable multi-factor authentication where possible, and monitor accounts for unauthorized activity. Network logs should be reviewed for connections to 216.198.79.67 or echo-web-chi.vercel.app to identify potential compromise.