device-io-start[.]netlify[.]app

This domain, device-io-start.netlify.app, is actively engaged in credential harvesting phishing operations targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate authentication portals to capture sensitive credentials, including usernames, passwords, and multi-factor authentication tokens. The infrastructure is designed to evade initial detection by leveraging trusted hosting platforms, increasing the likelihood of successful exploitation against unsuspecting users. Infrastructure analysis reveals the domain is hosted on Netlify, a platform commonly used for rapid deployment of static sites, and resolves to the IP address 63.176.8.218. The SSL certificate is issued by DigiCert Inc, providing a false sense of security to victims. As of the latest scan, 6 out of 95 security vendors on VirusTotal have flagged this domain as malicious, with additional community reports confirming its involvement in phishing campaigns. The domain remains active, with no evidence of takedown or remediation efforts. Users who have visited device-io-start.netlify.app or entered credentials on the site should immediately revoke any exposed credentials and enable multi-factor authentication on all critical accounts. Network administrators are advised to block the domain and associated IP address at the perimeter level. Endpoint protection solutions should be updated to include this domain in their blocklists. Monitor for unusual authentication attempts or unauthorized access, particularly on accounts linked to corporate or financial services. If credentials were submitted, initiate a password reset across all platforms where the same credentials may have been reused.