protocol-connection[.]vercel[.]app

Analysis of protocol-connection.vercel.app shows that the sub‑domain is currently flagged on a single public security blocklist and is actively blocked by the PhishDestroy feed. The domain was submitted to VirusTotal where 91 antivirus and URL‑reputation engines evaluated the host; none returned a positive classification. While the lack of detections may indicate that the payload has not yet been captured by the participating scanners, it does not constitute evidence of safety, especially given the blocklist entry.

No additional intelligence such as registrar details, IP address, ASN, SSL certificate information, or page‑title content is available in the supplied data set, so the underlying infrastructure cannot be fully profiled. The presence of the “vercel.app” suffix suggests the domain is hosted on Vercel’s serverless platform, a legitimate service that can be abused by threat actors to serve malicious pages, but this inference is based solely on naming conventions and not on observed hosting data. The current risk rating is “under investigation” and the status is marked as active, indicating that the domain may still be used in phishing campaigns.

Defenders should treat the domain as malicious until further forensic evidence clarifies its behavior. Recommended mitigations include adding protocol-connection.vercel.app to URL filtering lists, monitoring outbound connections to the host, and performing periodic re‑scans with updated threat‑intel feeds. Continuous observation is advised because the threat landscape around this sub‑domain may evolve as additional detections become available.