cosmic-raindrop-2e0f38[.]netlify[.]app

This domain, cosmic-raindrop-2e0e38.netlify.app, operates as a credential harvesting phishing site targeting users through fraudulent Web Mail login interfaces. The site is designed to deceive visitors into submitting sensitive authentication details, such as email credentials, by presenting a counterfeit login portal that closely resembles legitimate webmail services. Analysis indicates the domain is actively collecting user input, which is subsequently transmitted to attacker-controlled infrastructure for exploitation in further malicious activities, including account takeovers and unauthorized access to corporate or personal data repositories. Infrastructure analysis reveals the domain is hosted on Netlify’s platform and resolves to the IP address 35.157.26.135, located in AWS EC2’s eu-central-1 region (Germany). The domain is flagged by Google Safe Browsing for phishing and appears on one security blocklist. VirusTotal detection metrics show 14 out of 95 security vendors have classified the domain as malicious, with a focus on phishing-related threats. The SSL certificate, issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, does not mitigate the inherent risk posed by the site’s fraudulent content. The page title, 'Web Mail,' further corroborates the intent to impersonate legitimate email login portals. Users who have accessed cosmic-raindrop-2e0e38.netlify.app or submitted credentials through the site should immediately take corrective action. All exposed credentials must be invalidated and reset across any services where identical or similar login details were used. System administrators should review logs for connections to 35.157.26.135 and the domain in question, as well as monitor for unauthorized access attempts originating from user accounts that may have been compromised. Browser caches and saved passwords should be cleared to prevent automatic redirection to the malicious domain. Organizations are advised to implement additional authentication controls, such as multi-factor authentication, to mitigate the risk of credential-based attacks stemming from this phishing campaign.