poetic-bubblegum-e26dd8[.]netlify[.]app

This domain, poetic-bubblegum-e26dd8.netlify.app, operates as a high-risk brand impersonation site targeting Google users. Analysis indicates the infrastructure is designed to deceive visitors into submitting login credentials or sensitive information by mimicking legitimate Google services. The page title, "Ficohsa," does not align with the impersonated brand, suggesting either misdirection or an attempt to obscure the true nature of the operation. The domain is actively resolving and has not been taken down despite multiple security flags. Evidence supporting this assessment includes detection by 18 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging it as phishing. The domain is registered through Netlify and resolves to the IP address 63.176.8.218, hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. It appears on at least one security blocklist, and its SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), does not mitigate the malicious intent. The domain remains active as of the latest verification, indicating ongoing risk. Users who have visited poetic-bubblegum-e26dd8.netlify.app should immediately revoke any credentials entered on the site and monitor associated accounts for unauthorized activity. Browser-based password managers or saved credentials should be reviewed for potential exposure. If financial or personally identifiable information was submitted, affected parties should consider additional protective measures, such as credit monitoring or identity theft prevention services. Network administrators are advised to block the domain and its resolving IP at the perimeter to prevent further access.