cosmorphwarevalk[.]netlify[.]app

The domain cosmorphwarevalk.netlify.app is currently flagged as an active credential harvesting phishing site. Analysis indicates the threat type is a generic phishing campaign designed to mimic a legitimate connection verification page, likely targeting users of cloud services or financial platforms. No specific brand impersonation is confirmed, but the page title 'Checking your connection' suggests an attempt to deceive users into entering sensitive credentials under false pretenses. Infrastructure analysis reveals the domain is hosted on Netlify’s platform and resolves to the IP address 98.84.224.111, located in the United States under Amazon.com, Inc.’s AS14618. The SSL certificate is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 intermediate. Detection metrics show the domain is flagged by 1 of 95 security vendors on VirusTotal and appears on one security blocklist. The domain remains unregistered through traditional registrars, as it is a subdomain of Netlify’s app platform, which may complicate takedown efforts. As of the latest assessment, cosmorphwarevalk.netlify.app remains active and poses a high risk to users who may encounter it through malicious links in emails, social media, or compromised websites. Security teams are advised to block the domain and its associated IP address at the network level. Users should avoid interacting with the site, and organizations should monitor for credential reuse if exposure is suspected. Verification of any unexpected connection prompts through official channels is strongly recommended.