ecountt[.]vercel[.]app

This domain is part of a credential theft campaign designed to impersonate Google authentication services. It presents a deceptive login interface labeled "Ecount WebMail - Login" to trick users into entering sensitive account credentials. The infrastructure is consistent with phishing operations that rely on brand imitation and trusted UI mimicry to capture usernames, passwords, and potentially session tokens.

Technical intelligence indicates multiple risk signals. The domain was created on March 10 2026 and is registered through Vercel Inc., suggesting use of modern cloud hosting to rapidly deploy disposable phishing pages. VirusTotal analysis shows 19/95 security vendors flagging the domain as malicious. Additional indicators include an SSL certificate issued by Google Trust Services / WR1, which may be used to falsely increase perceived legitimacy. The domain is currently active, resolves to IP 216.198.79.195 located in the US under AS16509 Amazon.com, Inc., and appears on 1 security blocklist with blocking already enforced by PhishDestroy.

If a user has visited or interacted with this site, immediate containment actions are recommended. Credentials entered should be considered compromised and must be changed immediately on all affected accounts, starting with the impersonated Google account. Multi-factor authentication should be enabled or reviewed for unauthorized changes. Browser sessions should be cleared, and any downloaded files should be treated as potentially malicious. Security teams should inspect logs for unusual login attempts originating after exposure to the domain. Continued monitoring is advised due to the domain’s active status and infrastructure designed for rapid redeployment.