mellifluous-squirrel-599713[.]netlify[.]app

This domain, mellifluous-squirrel-599713.netlify.app, is confirmed to operate as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate authentication portals to capture sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. The infrastructure is designed to exploit trust in cloud-based hosting platforms, increasing the likelihood of successful social engineering attacks against unsuspecting victims. Infrastructure analysis reveals the domain is hosted on a platform registered through Netlify and resolves to the IP address 18.208.88.157, located within the Amazon.com, Inc. autonomous system (AS14618) in the United States. The domain currently holds a valid SSL certificate issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), which may lend a false sense of legitimacy to targets. Detection metrics show the domain is flagged by 2 security blocklists and has been identified as malicious by 2 out of 95 security vendors on VirusTotal, indicating a high-risk classification despite limited initial detection coverage. Users who have visited mellifluous-squirrel-599713.netlify.app or entered credentials on the site should immediately revoke any submitted information by changing passwords for all potentially compromised accounts. Enable multi-factor authentication where available, particularly for financial, email, and identity management services. Monitor accounts for unauthorized activity and report any suspicious transactions or login attempts. Organizations should add the domain and its resolving IP (18.208.88.157) to network blocklists and conduct internal reviews for signs of credential reuse or lateral movement. No legitimate services are associated with this domain, and all interactions should be treated as malicious.