rpc-interface[.]vercel[.]app

Analysis of rpc-interface.vercel.app as of 2026-08-03 indicates the domain is actively used in a generic phishing campaign. The site is listed on a single security blocklist and has been blocked by the PhishDestroy service, confirming that it is being used to distribute malicious content or to harvest credentials. VirusTotal records show that the domain was examined by 91 scanning engines; at the time of review none of those engines reported a detection. While the absence of detections does not constitute evidence of benign behavior, the combination of blocklist inclusion and PhishDestroy mitigation suggests a high likelihood of malicious intent.

No public registrar information, IP address, autonomous system number, or hosting provider details are presently available in the intelligence feed, limiting the ability to map the underlying infrastructure. Likewise, SSL/TLS certificate data, HTTP response codes, and page title metadata have not been disclosed, preventing a deeper content-based assessment. The lack of additional detections across other threat-sharing platforms further underscores the need for caution, as the campaign may be in an early stage or employing evasion techniques that evade automated scanners. Defenders should prioritize immediate containment actions.

The domain should be added to outbound filtering rules and DNS sinkhole configurations to prevent client connections. Monitoring of network traffic for any attempts to resolve or contact rpc-interface.vercel.app is advised, as is periodic re-query of VirusTotal and other reputation services for any change in detection status. Incident response teams should treat any credential submissions to the domain as potentially compromised and enforce credential rotation for affected accounts. Continuous intelligence gathering, including WHOIS lookups and passive DNS monitoring, is recommended to capture forthcoming infrastructure changes that may aid in attribution and takedown efforts.