nodeportals[.]vercel[.]app

This domain functions as a credential harvesting endpoint presenting itself as "Nodes Portal", likely designed to lure users into entering login or wallet-related authentication data. The infrastructure indicates a generic phishing page hosted on a cloud platform, enabling rapid deployment and takedown evasion. The page title "Nodes Portal" suggests impersonation of a service dashboard or node management interface to increase credibility.

Technical indicators confirm malicious classification: VirusTotal reports 2/95 security vendors flagging the domain as malicious. The domain was created on May 02, 2026 and is registered through Vercel Inc., indicating use of a rapid deployment hosting provider. It resolves to IP 216.198.79.67 located in the United States under CYPRESS COMMUNICATIONS, LLC. The domain is currently active and served over SSL issued by Google Trust Services (WR1). It is additionally listed on 2 security blocklists including PhishDestroy and ScamSniffer.

Users who have interacted with this domain should assume potential credential compromise. Any entered passwords, seed phrases, or authentication tokens should be considered exposed. Immediate mitigation includes changing all reused credentials, revoking active sessions, and moving any associated digital assets to secure accounts. Endpoint scans should be performed on affected devices to detect potential malware or browser credential theft. Continued monitoring for unauthorized access attempts is recommended.