cont-roan[.]vercel[.]app

Analysis indicates that cont-roan.vercel.app is an active phishing domain hosted on Vercel's platform, currently flagged by security vendors and blocklists. Infrastructure review reveals the domain was registered through Vercel Inc. and resolves to IP address 64.29.17.131, though nameserver records (NS_NOT_FOUND) suggest incomplete or misconfigured DNS settings. As of July 29, 2026, the domain appears on one security blocklist, and 15 of 91 security vendors on VirusTotal have detected it as malicious, consistent with phishing infrastructure. No brand target or scam type is explicitly confirmed in the available data, but the domain's structure and hosting pattern align with credential-harvesting campaigns, particularly those impersonating login portals.

The use of Vercel's app subdomain is a known tactic to leverage free hosting for phishing pages, often evading initial scrutiny due to the platform's legitimate use. The absence of nameserver records may indicate an attempt to obscure tracking or delay takedown efforts, though this is not conclusive. Defenders should treat this domain as elevated risk. Network-level blocking is recommended, particularly for organizations where credential theft could enable further compromise.

Security teams should monitor for connections to 64.29.17.131 and review logs for any interaction with cont-roan.vercel.app. While the exact content of the phishing page is not yet analyzed, the domain's detection history and infrastructure characteristics warrant immediate containment. Further investigation into the IP's hosting history and associated domains may reveal additional linked infrastructure.