0authxfinity[.]vercel[.]app

This domain, 0authxfinity.vercel.app, is identified as a high-severity phishing resource targeting users through fraudulent OAuth or identity verification interfaces. Analysis indicates the domain impersonates legitimate authentication flows, likely to harvest credentials or session tokens from unsuspecting victims. The inclusion of "xfinity" in the subdomain suggests an attempt to exploit trust in a major telecommunications provider, while the use of a platform-as-a-service hosting provider obscures infrastructure ownership and complicates takedown efforts. Infrastructure analysis reveals the domain resolves to the IP address 64.29.17.131, hosted within autonomous system AS16509, operated by a major cloud provider in the United States. The domain is registered through Vercel Inc., a platform commonly used for rapid deployment of web applications, which may have facilitated its swift activation and subsequent abuse. Detection metrics show 21 out of 95 security vendors on a multi-engine scanning platform flagged the domain as malicious, while Google Safe Browsing has explicitly classified it as phishing. The domain appears on two independent security blocklists, including specialized phishing repositories, confirming its malicious intent. As of the latest assessment, 0authxfinity.vercel.app has been taken offline, likely following abuse reports or automated enforcement actions by the hosting provider. While the immediate threat has been mitigated, residual risk persists due to potential reuse of collected credentials or reactivation under similar domains. Users who may have interacted with the site are advised to invalidate any entered credentials, enable multi-factor authentication on sensitive accounts, and monitor for unauthorized access. Organizations should update detection rules to include the observed indicators, including the IP address and SSL certificate issuer, to prevent future exposure.