accountcenter-docuplexa-dsa1509xz[.]netlify[.]app

This domain, accountcenter-docuplexa-dsa1509xz.netlify.app, is identified as a credential phishing endpoint designed to harvest user login credentials. The page title, 'Password Protection,' suggests an attempt to mimic legitimate authentication portals, likely targeting enterprise or document management service users. No specific brand impersonation or drainer kit signatures were confirmed, though the infrastructure aligns with common phishing toolkits observed in credential theft campaigns. Analysis indicates the domain is hosted on Netlify’s platform and resolves to IP address 18.208.88.157, associated with AS14618 (Amazon.com, Inc.) in the United States. The SSL certificate is issued by DigiCert Inc under the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' chain. VirusTotal detection metrics show 19 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is currently not listed in Google Safe Browsing. No creation date was provided, but the active status and recent blocklist additions suggest recent deployment. The domain remains active as of the latest verification, posing a continued risk for credential compromise. Response actions by security providers have included blocklisting, though the infrastructure persists. Organizations should implement network-level blocking of the domain and associated IP, monitor for related phishing attempts, and educate users on recognizing authentication-themed phishing lures. Given the high detection rate and active status, this domain warrants immediate mitigation to prevent potential credential exposure.