bellloginebill[.]netlify[.]app

This domain, bellloginebill.netlify.app, is flagged as a high-risk credential phishing site designed to impersonate Bell, a telecommunications provider. Analysis indicates the threat type is credential harvesting, where attackers mimic legitimate login portals to steal user credentials. The domain hosts a fraudulent login page titled 'Bell,' suggesting it targets customers of the brand by replicating its authentication interface. No specific drainer kit has been conclusively identified, but the infrastructure aligns with common phishing toolkits used for large-scale credential theft. Infrastructure analysis reveals several critical technical indicators. The domain resolves to the IP address 63.176.8.218, hosted on an AWS EC2 instance in Frankfurt, Germany (eu-central-1). It is registered through Netlify, a platform frequently exploited for rapid phishing deployment due to its ease of use and free hosting capabilities. The SSL certificate is issued by DigiCert Inc under the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' chain, which, while legitimate, is often abused to lend false credibility to malicious sites. VirusTotal detection shows 7 out of 95 security vendors flagging the domain as malicious, and it appears on one security blocklist. The domain remains unlisted on Google Safe Browsing as of the latest scan, highlighting a potential gap in detection coverage. The domain remains active and continues to pose a significant risk to unsuspecting users. Despite being blocked by PhishDestroy, the site is still operational, indicating either delayed takedown enforcement or evasion tactics. Users who interact with this domain risk exposing their Bell account credentials, which could lead to unauthorized access, financial fraud, or further targeted attacks. Organizations and individuals are advised to block the domain and IP at the network level, implement multi-factor authentication for all accounts, and conduct user awareness training to recognize phishing attempts. Monitoring for similar domains using Netlify or AWS infrastructure is recommended to preemptively mitigate related threats.