sxghrfsertt6yuer5rtgdhf-strhg5y4wsz[.]vercel[.]app

This domain, sxghrfsertt6yuer5rtgdhf-strhg5y4wsz.vercel.app, is actively engaged in credential phishing targeting users of a major cloud productivity suite. Analysis of the hosted content reveals a fraudulent login portal designed to mimic the authentication interface of Microsoft services, including Office 365 and Outlook. The page employs convincing visual elements, such as corporate branding and input fields for email and password, to deceive victims into submitting sensitive credentials. Once entered, the stolen data is likely transmitted to attacker-controlled infrastructure for subsequent unauthorized access or account takeover operations. Infrastructure analysis reveals the domain was registered through Vercel Inc. on April 28, 2026, and currently resolves to the IP address 64.29.17.3, hosted within the United States. Security vendor detection on VirusTotal stands at 15 out of 95 engines, indicating moderate but growing recognition of the threat. The domain appears on at least one security blocklist, and its SSL certificate is issued by Google Trust Services under the WR1 intermediate. The use of a legitimate hosting provider and valid SSL certificate increases the perceived legitimacy of the phishing page, complicating user detection. Users who have visited sxghrfsertt6yuer5rtgdhf-strhg5y4wsz.vercel.app or entered credentials on the site should immediately revoke any submitted information. Affected accounts must undergo password resets, and multi-factor authentication should be enabled where available. System scans using updated security tools are recommended to detect potential secondary infections or data exfiltration. Network administrators are advised to block the domain and its resolving IP address at the perimeter to prevent further exposure within organizational environments.