gilded-froyo-55cb12[.]netlify[.]app

This domain, gilded-froyo-55cb12.netlify.app, is identified as an active credential phishing site targeting webmail users. The page impersonates generic email login portals, as evidenced by its title, 'Webmail :: Welcome to Webmail,' designed to harvest authentication credentials. Analysis indicates the threat type is classified as generic_phishing with a high-risk assessment due to its operational status and detection metrics. Infrastructure analysis reveals the domain is hosted on Netlify and resolves to the IP address 63.176.8.218, geolocated in Germany under AS16509 (Amazon.com, Inc.). The domain was registered on March 05, 2026, though this date may reflect platform-specific record-keeping rather than traditional WHOIS registration. Security vendor detections include 19 of 95 engines on VirusTotal flagging the domain, while it appears on one additional security blocklist. The SSL certificate is issued by DigiCert Inc, specifically under the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' intermediate authority, which does not inherently indicate malicious intent but is consistent with phishing infrastructure leveraging legitimate certificate providers. As of the latest verification, the phishing page remains active and accessible. Organizations and users are advised to block the domain and its resolving IP (63.176.8.218) at the network perimeter. Endpoint protection systems should be updated to include this indicator of compromise, and security teams are recommended to monitor for credential submission attempts originating from internal networks. User awareness training should emphasize the risks of entering credentials on unverified login portals, particularly those hosted on content delivery platforms.