nodes-connect[.]vercel[.]app

nodes-connect.vercel.app was registered on 21 February 2026 through Tucows Domains Inc. The domain resolves to the IPv4 address 64.29.17.131, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated to the United States. The TLS certificate presented by the site is signed by Google Trust Services and chains to the WR1 intermediate, confirming that encryption is correctly configured but offering no validation of the site’s ownership. Infrastructure fingerprints show the Vercel platform and the presence of HTTP Strict Transport Security, both typical of legitimate SaaS deployments.

An HTTP GET returns a 404 status code and the page title “404: NOT_FOUND”, indicating that no visible payload is currently hosted. VirusTotal reports three positive detections out of ninety‑three scanners, and five independent blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have flagged the domain. The threat is classified as generic phishing with an elevated risk rating, and the current operational status is offline.

No additional artifacts such as credential‑collection forms, branding elements, or redirect chains have been observed, leaving the exact phishing lure and targeted brand unspecified. Defenders should continue to block the IP address and domain at firewalls and proxy appliances, incorporate the listed indicators into URL filtering and endpoint detection rules, and monitor for any re‑deployment on alternative cloud providers. Ongoing intelligence feeds should be consulted for potential resurgence or for other domains that share the same registrar, hosting provider, or certificate authority.