billiway[.]netlify[.]app

This domain is flagged as a high-risk phishing infrastructure specifically designed to impersonate Bell, a telecommunications provider. Analysis indicates the site is engineered to harvest user credentials through a fraudulent login portal, leveraging brand trust to deceive targets. The threat type is classified as brand impersonation phishing, with no evidence of crypto-drainer or malware distribution functionality at this time. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 63.176.8.218, hosted on Amazon.com, Inc. (AS16509) infrastructure located in Germany. The page title is explicitly set to 'Bell,' reinforcing the impersonation theme. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious. The domain is registered through Netlify, a legitimate platform often abused for rapid phishing deployment. An SSL certificate issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1) is present, providing a false sense of security. The domain appears on at least one security blocklist and is actively blocked by enterprise-grade phishing detection systems. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (63.176.8.218) at the network perimeter. Organizations should deploy email and web filtering rules to prevent delivery or access to the domain. End-users should be educated on recognizing brand impersonation tactics, particularly the use of legitimate-looking login portals hosted on third-party platforms (e.g., Netlify). Security teams are advised to monitor for credential theft indicators, such as unusual authentication attempts from the IP range associated with this campaign. If credentials were entered, immediate password resets and multi-factor authentication enforcement are critical. Network logs should be reviewed for connections to the domain or IP to identify compromised accounts.