matrix-relay-2745[.]vercel[.]app

This domain, matrix-relay-2745.vercel.app, is actively engaged in credential harvesting operations targeting users of cloud infrastructure services. Analysis indicates the page employs a 'Deployment Paused' pretext to deceive visitors into entering sensitive authentication details, which are then exfiltrated to attacker-controlled servers. The threat specifically mimics legitimate cloud deployment platforms, increasing the likelihood of successful social engineering against technical users. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 21, 2026, through Tucows Domains Inc., an unusual registrar choice for legitimate cloud services. It resolves to IP address 64.29.17.3 within Amazon's AS16509 network and presents a Google Trust Services SSL certificate (WR1), adding a false layer of legitimacy. Security vendors have flagged this domain in 3 out of 95 VirusTotal scans, while two independent blocklists—PhishDestroy and ScamSniffer—have already classified it as malicious. The page title 'Deployment Paused' serves as a technical lure, suggesting the domain targets users familiar with cloud deployment workflows. Users who have visited matrix-relay-2745.vercel.app should immediately revoke any credentials entered on the site, particularly cloud service accounts, database logins, or API keys. Perform a full antivirus scan using updated definitions to detect potential secondary payloads. Monitor all accounts associated with the affected email addresses for unauthorized access attempts, especially those linked to cloud platforms or development environments. Network administrators should add the domain and its resolving IP (64.29.17.3) to perimeter blocking rules. Given the domain's recent creation date and active status, organizations should treat this as an ongoing campaign and update detection signatures accordingly.