ecount-smoky[.]vercel[.]app

This domain, ecount-smoky.vercel.app, is actively engaged in brand impersonation targeting Google, specifically designed to harvest user credentials. The page presents itself as 'Ecount WebMail - Login,' mimicking legitimate Google login portals to deceive users into submitting sensitive account information. Analysis confirms the domain remains operational and unmitigated as of the latest verification. Infrastructure analysis reveals the domain is hosted on Vercel Inc. infrastructure, resolving to IP address 216.198.79.3, geolocated within the United States under AS16509 (Amazon.com, Inc.). The domain has been flagged by 18 of 95 security vendors on VirusTotal, indicating broad detection of malicious intent. It appears on one security blocklist, specifically PhishDestroy, and utilizes an SSL certificate issued by Google Trust Services (WR1). No historical registration data or creation date was provided, but the domain’s active status and technical indicators align with known credential theft campaigns. The domain remains active and poses a high risk to users encountering it through phishing vectors such as email, SMS, or malvertising. Organizations are advised to implement DNS-level blocking for ecount-smoky.vercel.app and its resolving IP, 216.198.79.3. Endpoint protection systems should be updated to include this domain in deny lists, and security teams should monitor for related indicators of compromise, such as unusual authentication attempts or unauthorized access originating from affected accounts. User awareness training should emphasize verification of login portals, particularly those claiming affiliation with Google services.