trustconnect[.]vercel[.]app

This domain, trustconnect.vercel.app, operates as an active credential harvesting phishing site designed to deceive users into submitting sensitive authentication details. Analysis indicates the infrastructure is engineered to mimic legitimate login portals, likely targeting users of cloud services or financial platforms. The site employs social engineering tactics, such as fabricated urgency or impersonation of trusted entities, to manipulate victims into disclosing credentials, which are then exfiltrated to attacker-controlled servers for unauthorized access or financial fraud. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on February 21, 2026, through Tucows Domains Inc., an unusual timeline suggesting potential domain squatting or premeditated malicious activity. It resolves to IP address 64.29.17.195, hosted on Amazon.com, Inc. infrastructure (AS16509), a common pattern observed in phishing campaigns leveraging reputable cloud providers to evade detection. The domain appears on two independent security blocklists, including PhishDestroy and PhishingDB, and is flagged by 18 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. The SSL certificate, issued by Google Trust Services (WR1), further complicates detection by presenting a seemingly legitimate encrypted connection while masking malicious intent. Users who have interacted with trustconnect.vercel.app should immediately revoke any submitted credentials, particularly for services resembling those impersonated by the site. Monitor associated accounts for unauthorized activity, including login attempts, financial transactions, or configuration changes. If authentication tokens or session cookies were exposed, invalidate them immediately. Network-level indicators, such as the resolving IP 64.29.17.195, should be added to perimeter security controls to prevent further access. Organizations are advised to conduct a retrospective analysis of logs for connections to this domain or IP, correlating with any anomalous user behavior. Given the domain's persistence despite blocklist inclusion, heightened vigilance is warranted for similar infrastructure patterns, such as domains registered through Tucows or hosted on cloud providers with recent creation dates.