qiye-163-com-login[.]netlify[.]app

This domain, qiye-163-com-login.netlify.app, is identified as a brand impersonation threat targeting NetEase Enterprise Email services. The page title, 网易企业邮箱 - 登录入口, directly mimics the legitimate login portal of NetEase’s corporate email platform, a common tactic to deceive users into entering credentials. Analysis indicates no evidence of a cryptocurrency drainer or advanced malware payload; instead, the primary objective appears to be credential harvesting through a fraudulent login interface. The domain does not exhibit characteristics of a known phishing kit, suggesting a custom or manually deployed impersonation scheme. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 63.176.8.218, located in Germany under Amazon.com, Inc. (AS16509). The domain is registered through Netlify, a platform frequently abused for hosting phishing content due to its ease of deployment and free SSL certificates. The SSL certificate is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1, which is not inherently malicious but is commonly leveraged in phishing campaigns to lend false legitimacy. Detection metrics show that 20 out of 95 security vendors on VirusTotal have flagged this domain as malicious. Additionally, the domain appears on two security blocklists, further corroborating its classification as a phishing threat. No creation date is available, but the domain’s rapid detection and takedown suggest recent deployment. As of the latest assessment, qiye-163-com-login.netlify.app has been taken offline, likely in response to abuse reports or automated detection mechanisms. While the immediate threat has been mitigated, the infrastructure used—such as the hosting provider and SSL certificate authority—remains accessible for future abuse. Users who may have interacted with this domain are advised to reset credentials immediately, particularly for NetEase Enterprise Email accounts, and monitor for unauthorized access. Organizations should implement domain-based blocking for known phishing patterns, such as those mimicking enterprise login portals, and enforce multi-factor authentication to mitigate credential theft risks. Continuous monitoring of similar domains, especially those using cloud-based hosting platforms, is recommended to preempt further impersonation attempts.