ecount-update[.]vercel[.]app

This domain, ecount-update.vercel.app, is actively engaged in credential theft, specifically targeting users of Ecount WebMail services. The fraudulent page mimics the legitimate Ecount WebMail login interface, presenting a high-fidelity replica designed to harvest usernames and passwords. Analysis indicates the domain is structured to deceive enterprise users, likely through phishing emails or malicious redirects, exploiting trust in the Ecount brand to facilitate unauthorized access to sensitive accounts. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to the IP address 216.198.79.67, hosted under CYPRESS COMMUNICATIONS, LLC in the United States. It is registered through Vercel Inc., a platform commonly abused for rapid deployment of phishing sites. VirusTotal reports 20 out of 95 security vendors flagging this domain as malicious, while it also appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WR1), provides a false sense of security, as the underlying content remains fraudulent. No legitimate creation date or historical WHOIS data was available, further suggesting a disposable, attack-focused deployment. Users who have interacted with ecount-update.vercel.app should immediately take corrective action. Any credentials entered on this domain must be considered compromised and changed without delay, prioritizing accounts tied to Ecount or other critical services. Enable multi-factor authentication where available to mitigate unauthorized access. Organizations should review logs for connections to 216.198.79.67 or the domain itself, as these serve as concrete indicators of compromise. If browser sessions were active during the visit, clear all cached data and run a full system scan to detect potential secondary infections. Report the domain to internal security teams or relevant threat intelligence platforms to aid in broader mitigation efforts.