xow[.]fi

Analysis of the domain xow.fi indicates active phishing infrastructure targeting users through a Vercel-branded security checkpoint deception. Registered on June 18, 2026, via Key-Systems GmbH, the domain resolves to IP address 104.21.17.252 and presents a page titled 'Vercel Security Checkpoint,' suggesting an attempt to exploit trust in the Vercel platform. The domain holds a Gridinsoft trust score of 0/100 and appears in 14 threat intelligence pulses on AlienVault OTX, reinforcing its classification as malicious. Four security blocklists, including SEAL and PhishDestroy, have flagged the domain, while MetaMask and BLP-Malware have implemented active blocks. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to phishing pages. Despite the absence of detections in recent vendor scans, this does not confirm safety, as phishing domains often evade detection during early deployment. The domain remains active as of July 12, 2026, with no confirmed takedown or sinkholing. Defenders should prioritize blocking this domain at DNS and network levels, particularly in environments where Vercel services are utilized. Further analysis of the page content and backend infrastructure is recommended to determine the exact payload or credential-harvesting mechanism, though no specific brand impersonation beyond the Vercel reference has been confirmed.