dynamic-yeot-cfe7fa[.]netlify[.]app

This domain, dynamic-yeot-cfe7fa.netlify.app, is actively engaged in credential theft targeting users through a fraudulent webmail sign-in interface. Analysis indicates the page mimics legitimate email login portals, likely harvesting usernames, passwords, and other authentication credentials for unauthorized account access or subsequent malicious activities. The threat is classified as high-risk due to its operational status and targeted nature, which poses significant risks to both individual and organizational security. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Name.com, Inc, under the Netlify hosting platform. It resolves to the IP address 35.157.26.135, located in Germany and associated with AS16509 (Amazon.com, Inc.). The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is flagged by 20 out of 95 security vendors on VirusTotal. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), does not mitigate the threat, as the underlying infrastructure remains compromised. Users who have visited dynamic-yeot-cfe7fa.netlify.app or entered credentials on the site should immediately revoke any submitted login details by changing passwords for all associated accounts. Multi-factor authentication should be enabled where available to prevent unauthorized access. System scans using updated security tools are recommended to detect potential malware or backdoors. Organizations should alert their security teams and consider implementing additional monitoring for suspicious login attempts originating from affected users. Given the domain's active status, caution is advised when encountering similar webmail-themed URLs, particularly those hosted on third-party platforms.