strongbonbonbun[.]netlify[.]app

The domain strongbonbonbun.netlify.app has been identified as a high-risk generic phishing site. The threat type is categorized as a fake login page, designed to deceive users into submitting sensitive credentials. There is no specific brand impersonation or crypto drainer kit noted in the current intelligence.

Analysis indicates that the domain is flagged by 20 out of 95 security vendors on VirusTotal, suggesting a significant consensus among security researchers regarding its malicious nature. The domain is registered through Netlify and resolves to the IP address 63.176.8.218, which is located in Germany (DE) and is part of the AS16509 network, associated with Amazon.com, Inc. The SSL certificate is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1. The domain appears on one known security blocklist and is currently listed in the Google Safe Browsing database. The creation date of the domain is not provided, but it remains active and poses an ongoing threat.

The current status of strongbonbonbun.netlify.app is active, indicating that it continues to operate and may still be used for phishing attacks. Users are advised to avoid accessing this domain and to report any phishing attempts to their respective security teams. Organizations should consider implementing additional security measures such as DNS blacklisting and user education to mitigate the risk of credential theft. Despite being flagged and listed, the domain remains accessible, and the remaining risk is high due to its ongoing activity and the potential for credential harvesting.