peee-dash-zim-six[.]vercel[.]app

On July 22, 2026 the domain peee-dash-zim-six.vercel.app was observed hosting a page titled “Zimbra Web Client Sign In”. The site was built on the Vercel platform and served the HSTS header, indicating TLS enforcement. The TLS certificate was issued by Google Trust Services, which is typical for Vercel‑hosted sites. DNS resolution returned the IP address 64.29.17.195, which belongs to the Amazon.com, Inc. AS16509 network and is located in the United States. An HTTP request returned a 404 status code, and the domain is currently taken offline.

Threat intelligence shows that one of ninety‑one VirusTotal scanners flagged the domain, and the domain is listed on a single security blocklist. It has also been added to the PhishDestroy blocklist. The registrar information lists Vercel Inc. as the registration entity, and no nameserver data were returned. The combination of a legitimate‑looking page title referencing the Zimbra email client and the use of a reputable hosting provider suggests a credential‑harvesting campaign targeting Zimbra users.

However, the limited detection coverage (only one vendor flag) and the absence of additional indicators such as malware payloads or compromised credentials leave the full scope of the campaign uncertain. Defenders should block any outbound connections to 64.29.17.195 and add peee-dash-zim-six.vercel.app to DNS sinkhole or proxy deny lists. Continuous monitoring of Vercel‑hosted domains that reference “Zimbra” in their page titles is advised, as attackers may reuse the same infrastructure for future campaigns. Organizations should also educate users about unexpected Zimbra login prompts and enforce multi‑factor authentication for email accounts to mitigate credential theft.