frostyz[.]netlify[.]app

This domain, frostyz.netlify.app, operates as a credential harvesting site designed to deceive users into entering login credentials. The page displays a generic but convincing 'Sign in to your Account' interface, mimicking common authentication portals. Analysis indicates the site is likely targeting users of popular email, cloud storage, or financial platforms, though no specific brand impersonation is immediately evident. The threat lies in the site's ability to capture and exfiltrate entered credentials, which can then be used for unauthorized account access, identity theft, or further phishing campaigns. Infrastructure analysis reveals the domain is hosted on Netlify, a legitimate platform often abused for phishing due to its free hosting and ease of deployment. The site resolves to the IP address 35.157.26.135, and as of the latest scan, 7 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The domain remains active, and there is no evidence of takedown efforts at this time. The combination of a generic but plausible login interface, active hosting, and confirmed detections by multiple security engines underscores the high-risk nature of this threat. Users who have visited frostyz.netlify.app and entered credentials should assume their information has been compromised. Immediate steps include changing passwords for any accounts accessed or entered on the site, enabling multi-factor authentication where available, and monitoring accounts for unusual activity. If financial or sensitive platforms were accessed, consider placing fraud alerts with relevant institutions. Additionally, review browser history and installed extensions for any unauthorized changes, as phishing sites may attempt to install malicious software. Organizations should block the domain and IP address at the network level to prevent further exposure.