rackspacliningsmaservico[.]vercel[.]app

This domain, rackspacliningsmaservico.vercel.app, is identified as a credential theft operation impersonating Rackspace Webmail, a hosted email service for businesses. Analysis indicates the page title explicitly mimics the legitimate Rackspace Webmail portal, suggesting an intent to harvest corporate or personal email credentials. No evidence of a crypto drainer kit or payment diversion mechanism was observed, distinguishing this as a targeted credential harvesting campaign rather than a financial fraud scheme. Infrastructure analysis reveals the domain was registered through Vercel Inc. and resolves to the IP address 64.29.17.3, hosted on Amazon.com, Inc. infrastructure (AS16509). The domain is flagged by 18 out of 95 security vendors on VirusTotal, with detections spanning phishing and malicious URL categories. It appears on two independent security blocklists, PhishDestroy and PhishingDB, and is associated with an SSL certificate issued by Google Trust Services (WR1). No creation date was provided, but the domain is currently offline, limiting further temporal analysis. Google Safe Browsing status remains unconfirmed due to the domain's recent takedown. Current status indicates the domain has been taken offline, likely in response to blocklist inclusions and vendor detections. However, the risk of reemergence persists, as threat actors frequently redeploy phishing infrastructure under new subdomains or registrars. Organizations are advised to monitor for similar impersonation attempts, particularly those leveraging cloud hosting providers for rapid deployment. End-users should verify domain authenticity before entering credentials, and security teams should prioritize blocking known indicators, including the resolved IP and associated SSL certificate issuer.