elegant-bonbon-9f185d[.]netlify[.]app

The domain elegant-bonbon-9f185d.netlify.app is currently classified as an active generic phishing threat specializing in credential harvesting. Analysis indicates the site mimics legitimate authentication portals to deceive users into submitting sensitive login information, including usernames, passwords, and potentially multi-factor authentication codes. No specific brand impersonation has been confirmed, but the infrastructure aligns with broad-scale phishing campaigns targeting corporate and personal accounts. Infrastructure analysis reveals the domain is hosted on Netlify’s platform, resolving to the IP address 63.176.8.218 within the Amazon.com, Inc. autonomous system (AS16509) located in Germany. The SSL certificate, issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, provides HTTPS encryption but does not validate legitimacy. Detection metrics show the domain is flagged by 2 of 95 security vendors on VirusTotal and appears on 2 independent security blocklists. Additional monitoring systems, including PhishDestroy and ScamSniffer, have actively blocked access to this domain due to confirmed malicious activity. Current status remains active, with no evidence of takedown or mitigation. Users are advised to avoid interaction with elegant-bonbon-9f185d.netlify.app and any associated subdomains. Organizations should update web filtering rules to block the domain and IP address 63.176.8.218 at the network perimeter. Individuals who may have entered credentials on this site should immediately reset passwords for all potentially compromised accounts and enable multi-factor authentication where available. Security teams are encouraged to monitor for indicators of compromise, including the domain’s SSL certificate fingerprint and resolved IP address, to detect related phishing infrastructure.