source-flow-hub[.]vercel[.]app

Analysis of source-flow-hub.vercel.app as of 2026-08-02 shows that the domain is actively used in a generic phishing campaign and is currently under investigation. The domain resolves to the IPv4 address 64.29.17.131, which is hosted on the Vercel platform; registration information indicates Vercel as the registrar. The domain appears on three independent security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering solutions, confirming that multiple threat‑intelligence feeds have identified malicious activity associated with this host.

VirusTotal has processed the domain with 91 commercial and community scanners; none of the engines generated a detection at the time of analysis, but the absence of a flag does not constitute a safety guarantee. No additional telemetry such as SSL certificate details, HTTP response codes, page titles, or content signatures is available in the current intelligence set, leaving the exact phishing payload and target brand undefined. The combination of blocklist presence, hosting on a shared cloud service, and the lack of public reputation signals suggests a high likelihood of abuse.

Defenders should continue to block the domain at network perimeter devices, update endpoint and browser protection policies to include the listed blocklists, and monitor for any outbound connections to 64.29.17.131. Incident response teams should collect DNS query logs, examine any authentication attempts that may have involved the domain, and, if feasible, request a sinkhole or takedown from the Vercel registrar. Ongoing reconnaissance is recommended to capture any future changes in the domain’s hosting or content that could alter its risk profile.