connect-rpc[.]vercel[.]app

connect-rpc.vercel.app is presently flagged on one external blocklist and is actively blocked by the PhishDestroy intelligence feed. The domain was submitted to VirusTotal, where 91 scanning engines examined the site; none produced a positive detection. While the lack of detections suggests that the sample did not match known malware signatures at the time of analysis, it does not eliminate the possibility of novel or file‑less phishing techniques. No entries for the domain appear in Google Safe Browsing, Open Threat Exchange, or comparable reputation services, and no public evidence of a registered owner, creation date, or hosting IP address has been released in the current dataset.

Consequently, infrastructure profiling—including autonomous system number, geographic location, and TLS certificate details—cannot be confirmed. Likewise, HTTP status codes, page title, or content snippets have not been captured, leaving the exact phishing vector and targeted brand undefined. Given the blocklist presence and the uncertainty surrounding the site’s infrastructure, defenders should assume the domain is malicious.

Immediate mitigation steps include adding the FQDN to outbound proxy deny lists, configuring DNS sinkholing for the name, and alerting SIEM rules on any authentication traffic directed to the host. If legitimate traffic is observed, responders should collect full HTTP request/response logs, TLS handshakes, and any payloads for further analysis, and submit the artifacts to shared analysis platforms to improve detection breadth. Continuous monitoring is advised, as additional blocklist entries or vendor detections may emerge.