zimbra-blue[.]vercel[.]app

Analysis indicates that the domain zimbra-blue.vercel.app was registered on 21 February 2026 through Tucows Domains Inc. It resolves to IP 64.29.17.131, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The site is hosted on the Vercel platform and serves an SSL certificate issued by Google Trust Services under the WR1 label, with HSTS enabled. An HTTP request returns a 404 status and the page title "404: NOT_FOUND", suggesting the content is currently unavailable or the site has been taken offline. Despite the offline status, the domain appears on a public phishing blocklist and is listed as blocked by PhishDestroy.

VirusTotal has recorded detections from 13 of 93 scanning engines, confirming that a subset of security vendors consider the domain malicious. The domain’s risk rating is elevated, and it has been classified as generic phishing in the provided intelligence. While the exact phishing payload or impersonated brand has not been observed, the combination of recent registration, cloud hosting, TLS configuration, and multiple vendor detections provides sufficient evidence for defensive action.

Defenders should continue to deny network traffic to the domain, ensure that URL filtering and DNS sinkhole rules include both the domain and its resolved IP address, and monitor for any re‑registration or activation attempts. Additional scrutiny of outbound connections to the AS16509 Amazon network may be warranted, and incident response teams should treat any emails or messages referencing the domain as potentially malicious. Ongoing threat‑intel feeds should be consulted for updates, and removal from allow‑lists should be enforced across all security controls.