gmxauthe[.]vercel[.]app

PhishDestroy identifies gmxauthe.vercel.app as an active credential-theft page masquerading as a GMX webmail login portal. The domain delivers a near-exact clone of the legitimate GMX authentication interface to trick users into entering their email address and password, which are then exfiltrated to attacker-controlled servers. The infrastructure leverages Vercel’s edge network (IP 216.198.79.67, Google Trust Services SSL) to evade traditional host-based filtering while avoiding immediate antivirus detection. This domain was flagged 2 times on authoritative blocklists including OpenPhish and OISD, yet remains undetected by 95 VirusTotal engines as of the latest scan. The domain is registered through Vercel Inc. and resolves to AS36069, indicating recent hosting setup optimized for short-lived campaigns rather than long-term abuse. Unlike generic phishing lures, the page combines HTTPS trust indicators with real-time form validation to improve conversion rates against wary users. If you entered credentials on gmxauthe.vercel.app, immediately change your GMX password using a clean device and revoke any third-party OAuth tokens tied to that account. Enable two-factor authentication on GMX and scan local machines for credential-stealing malware. Report the incident to GMX abuse and consider rotating passwords for any account that reused the same email/password combination elsewhere.