zimbra-nine[.]vercel[.]app

Analysis of the domain zimbra-nine.vercel.app, observed on July 23, 2026, indicates that the site is presently offline, returning HTTP status 451. The page title retrieved before takedown was “Zimbra Web Client Sign In,” a typical indicator of credential‑phishing targeting users of the Zimbra collaboration platform. The SSL certificate presented by the host is issued by Google Trust Services under the WR1 intermediate, confirming that TLS termination is performed by the hosting provider rather than by the attacker. Infrastructure inspection shows the domain resolves to the IP address 216.198.79.131, which belongs to Amazon.com, Inc. (AS16509) and is hosted in the United States. Registration data lists Vercel Inc. as the registrar, consistent with the detected technology stack that includes Vercel’s deployment platform and the presence of HTTP Strict Transport Security (HSTS) headers.

No authoritative nameserver records could be obtained, as the query returned NS_NOT_FOUND, suggesting that the domain’s DNS configuration may have been altered or removed during the takedown process. Reputation signals reinforce the malicious classification. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal scans have recorded detections by 15 of 95 antivirus and URL‑reputation engines, providing independent corroboration of phishing activity.

The overall risk assessment is elevated, reflecting the combination of credential‑phishing indicators, confirmed hosting on a major cloud provider, and multiple vendor detections. Defenders encountering traffic to this domain should block the associated IP address and any future DNS resolutions for zimbra-nine.vercel.app. Monitoring of Vercel‑hosted subdomains and the AS16509 address space for similar phishing pages is advised.