public-xi-lemon[.]vercel[.]app

This domain, public-xi-lemon.vercel.app, has been identified as a high-risk brand impersonation threat targeting the brand 'across'. It features a page title specifically designed to mimic a legitimate login interface, 'Zimbra Web Client Sign In', which is intended to deceive users into providing sensitive information. The threat type classified for this domain is brand impersonation, and it does not appear to utilize a separate drainer kit.

Technical analysis indicates that this domain has a VirusTotal score of 21 out of 95 security vendors flagging it as malicious. The domain was registered through Vercel Inc. on January 28, 2020, which adds a layer of credibility to its malicious intent. It resolves to the IP address 64.29.17.3, associated with Amazon.com, Inc. (AS16509), and is currently listed on two security blocklists. The presence of a Google Trust Services SSL certificate offers a false sense of security to users, further complicating detection efforts.

The current status of the domain remains active, posing an ongoing risk to users attempting to interact with sites impersonating legitimate brands. The domain has been blocked by security tools such as PhishDestroy and PhishingDB, yet the domain continues to be operational. It is critical for organizations and individuals to remain vigilant and implement strict controls against accessing this domain. Users are advised to verify URLs before entering credentials and to report any suspicious activity to their respective security teams.