comcast-com[.]vercel[.]app

This domain, comcast-com.vercel.app, was identified as a credential phishing page targeting Xfinity customers. Analysis indicates the site was registered through Vercel Inc. and hosted on infrastructure resolving to IP address 216.198.79.3, associated with Amazon.com, Inc. (AS16509) in the United States. The SSL certificate is issued by Google Trust Services under the WR1 intermediate, a common configuration for Vercel-hosted domains. The page title, 'Xfinity Login,' directly aligns with the impersonated brand, reinforcing its classification as a brand impersonation threat. The domain appears on one security blocklist (PhishDestroy) and was flagged by 15 of 95 security vendors on VirusTotal, confirming its malicious classification.

A Scamadviser trust score of 1/100 further supports the assessment of elevated risk. The HTTP status returned was 451, indicating the domain may have been taken offline due to legal or policy enforcement, though this cannot be confirmed definitively. No nameservers were detected, which may suggest recent deregistration or technical misconfiguration. Infrastructure analysis reveals the use of Vercel’s platform, a legitimate hosting service frequently abused for phishing due to its free tier and ease of deployment.

HSTS was enabled, which does not mitigate the phishing risk but may indicate an attempt to appear legitimate. The domain is currently offline, though defenders should monitor for reactivation or migration to alternative infrastructure. No additional scam categorization (e.g., crypto, investment) or kit-specific indicators were present in the available data. Organizations should block this domain at the network level and alert users to the Xfinity impersonation attempt.