mymailbrinksternetsergr[.]vercel[.]app

This domain, mymailbrinksternetsergr.vercel.app, is identified as a phishing site designed to harvest Zimbra Web Client credentials. The page mimics the legitimate Zimbra Web Client Sign In interface, tricking users into entering sensitive login details such as usernames, passwords, and potentially multi-factor authentication codes. Such credentials can be exploited for unauthorized access to corporate email systems, data exfiltration, or further targeted attacks within an organization. The threat is particularly concerning for enterprise environments where Zimbra is deployed as a collaboration suite. Analysis indicates that the domain was registered through Vercel Inc. on January 28, 2020, and resolves to the IP address 216.198.79.195, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The domain appears on one security blocklist, and 21 out of 95 security vendors on VirusTotal have flagged it as malicious. The SSL certificate is issued by Google Trust Services, which, while not inherently malicious, is often leveraged by threat actors to lend a false sense of legitimacy to phishing pages. The combination of these indicators—low detection age, specific targeting of Zimbra users, and use of reputable hosting and certificate providers—elevates the risk profile of this domain. Users who have visited mymailbrinksternetsergr.vercel.app or entered credentials on the site should take immediate action. First, reset the compromised Zimbra account password from a secure device, ensuring the new password is unique and complex. Enable multi-factor authentication if not already active. Notify the organization’s IT or security team to monitor for unauthorized access or suspicious activity. Additionally, review recent account activity for signs of unauthorized logins or data access. If personal or sensitive information was entered, consider placing a fraud alert or credit freeze as a precautionary measure. Organizations should also assess whether this incident is part of a broader phishing campaign and implement additional security controls, such as email filtering or user training, to mitigate future risks.