hundoras[.]vercel[.]app

hundoras.vercel.app was registered on March 30 2026 through Vercel Inc. and resolves to the IPv4 address 216.198.79.131, which is geolocated to the United States and owned by Vercel. The site presents a TLS certificate issued by Google Trust Services under the WR1 program, indicating a valid HTTPS connection despite its malicious purpose. The landing page returns HTTP 200 and displays the title “Ecount WebMail - Login”, mimicking a corporate email portal to harvest credentials. Front‑end assets are served from Vercel and include jQuery loaded via a CDN, with HSTS enabled. No authoritative nameservers were returned, suggesting the default Vercel DNS configuration. Threat intelligence feeds flag the domain as high‑risk. VirusTotal records 19 detections out of 95 scanned security vendors, and independent scoring services give it a Gridinsoft score of 0/100 and a Scamadviser rating of 1/100. The domain is listed on a single public blocklist and has been manually added to the PhishDestroy blocklist, confirming active abuse. Defenders should block traffic to hundoras.vercel.app at the network perimeter and add the resolving IP 216.198.79.131 to endpoint deny lists. Email gateways should be tuned to detect the “Ecount WebMail” brand spoofing pattern, and users should be warned against entering credentials on any site presenting this exact title. Continuous monitoring of Vercel‑hosted domains for similar credential‑phishing templates is advised.