cameleonweaksl[.]vercel[.]app

PhishDestroy’s automated pipeline flagged cameleonweaksl.vercel.app as an active fake webmail login phishing page mimicking enterprise cloud mail portals. The landing page title ‘Webmail Sign-in’ confirms the attacker’s intent to harvest corporate or institutional credentials. No known commercial drainer kit signatures are detected, indicating a lightweight, template-driven phishing page likely assembled from open-source or underground toolkits. Brand impersonation targets generic webmail services rather than a specific provider, broadening the potential victim pool. cameleonweaksl.vercel.app resolves to IPv4 64.29.17.195 and was registered through Vercel Inc.; VirusTotal returns a detection ratio of 21/95 security vendors as of UTC 2024-05-27. The domain carries a Google Trust Services SSL certificate and is currently listed on one public blocklist. Creation date and hosting infrastructure point to recent provisioning, consistent with fast-flux infrastructure used to evade takedown. As of the last scan at seed 16f05e, the domain remains active and unresolved by Google Safe Browsing (GSB). Immediate response actions include continued network-level blocking via OISD signatures and SSL certificate revocation through Google Trust Services. Despite these measures, the elevated risk profile persists due to the absence of universal takedown vectors and the domain’s legitimate Vercel hosting, which complicates immediate shutdown. Users are advised to verify URLs before entering credentials and to enable multi-factor authentication on all webmail accounts to mitigate credential harvesting.