623026594302[.]vercel[.]app

This domain, 623026594302.vercel.app, is actively impersonating Microsoft Outlook authentication pages to deceive users into disclosing sensitive credentials. The site mimics legitimate login portals, presenting a high-risk threat for credential theft, account compromise, and potential follow-on attacks such as unauthorized access to corporate or personal data. Users encountering this domain may unknowingly submit login details, which are then harvested by threat actors for malicious purposes. Analysis indicates the domain was registered on February 21, 2026, through Tucows Domains Inc., an unusual timeline suggesting potential domain spoofing or misuse of registration services. Infrastructure analysis reveals the domain resolves to an IP address (64.29.17.195) hosted on Amazon.com, Inc. infrastructure (AS16509), a common tactic to blend malicious activity with legitimate cloud services. Security vendors have flagged this domain on VirusTotal, with 17 out of 95 engines detecting it as malicious, and it appears on two security blocklists, including PhishDestroy and PhishingDB. If you or someone in your organization has visited 623026594302.vercel.app or entered credentials on this site, immediate action is required. First, reset any passwords associated with the account, particularly for Microsoft services or email accounts. Enable multi-factor authentication (MFA) if not already active. Monitor accounts for unusual activity, such as unauthorized logins or changes to settings. Report the incident to your internal security team or relevant authorities to assist in tracking and mitigating the threat. Avoid interacting with the domain further, and ensure security tools are updated to block similar threats in the future.