ocabluebeneficios[.]netlify[.]app

This domain, ocabluebeneficios.netlify.app, is identified as a high-risk phishing infrastructure specifically targeting OCA customers through a fraudulent login portal titled OCA Mi Cuenta. Analysis confirms the domain is actively serving phishing content designed to harvest user credentials under the guise of the legitimate OCA account management service. The threat type is classified as credential harvesting with brand impersonation, and the page remains operational as of the latest verification. Infrastructure analysis reveals the domain is hosted on Netlify's platform and resolves to the IP address 35.157.26.135. VirusTotal detection metrics show 3 of 95 security vendors have flagged this domain as malicious, indicating partial but growing recognition of its harmful nature. The SSL certificate is issued by DigiCert Inc, providing a false sense of security to potential victims. No historical registration data is available through standard WHOIS queries due to the domain being a subdomain of Netlify's platform, which obscures traditional ownership details. The page title OCA Mi Cuenta precisely matches the legitimate service, increasing the likelihood of successful deception. Current status confirms the phishing page remains active and accessible. Organizations are advised to implement immediate network-level blocking of ocabluebeneficios.netlify.app and its resolving IP 35.157.26.135. End users should be alerted to verify domain authenticity before entering credentials, particularly for services matching OCA's branding. Security teams should monitor for credential reuse attempts stemming from this campaign and consider implementing multi-factor authentication requirements for all external service access to mitigate potential account takeovers resulting from this phishing operation.