xxxfinityyy[.]vercel[.]app

This domain is associated with a high-risk fake login campaign designed to impersonate a legitimate service and capture user credentials. Analysis of the observed content indicates brand impersonation through a sign-in page intended to resemble an authentic authentication portal. Such infrastructure is commonly used to harvest usernames, passwords, and related account information from unsuspecting visitors. The site remains active and accessible, increasing the likelihood of continued credential theft attempts and user exposure.

Infrastructure analysis reveals that xxxfinityyy.vercel.app is deployed through Vercel Inc. and currently resolves to IP address 64.29.17.195. The domain presents a page titled "Sign in to Xfinity," consistent with impersonation activity. Security telemetry shows VirusTotal detections of 19/95 vendors, indicating significant industry concern regarding the resource. The domain appears on 1 security blocklist and has been blocked by PhishDestroy. Hosting infrastructure is located in the United States, and the SSL certificate is issued by Google Trust Services / WR1. Current monitoring indicates that the domain remains active despite existing detections and blocklist coverage.

Users who interacted with this domain should treat any submitted credentials as compromised. Immediate password changes should be performed for affected accounts, with priority given to any accounts that reused the same credentials elsewhere. Multi-factor authentication should be enabled where available, and account activity should be reviewed for unauthorized access. Security teams should block access to the domain and associated indicators, monitor authentication logs for suspicious behavior, and investigate potential credential exposure. Continued caution is recommended because active impersonation infrastructure can be modified rapidly to target additional users or collect further sensitive information.