friendly-concha-1fb687[.]netlify[.]app

This domain, friendly-concha-1fb687.netlify.app, is identified as a credential phishing site designed to harvest user login credentials. The page title, Sign In., suggests a generic but effective lure targeting authentication portals, likely mimicking legitimate services to deceive victims. No specific brand impersonation or drainer kit signatures were detected in initial scans, though the infrastructure aligns with common phishing deployment patterns. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain resolves to IP address 35.157.26.135, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in Germany. It is registered through Netlify, a platform frequently abused for rapid phishing deployment due to its ease of use and free hosting capabilities. The SSL certificate is issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, providing a false sense of security. Detection metrics confirm its malicious nature: 20 out of 95 security vendors on VirusTotal flag the domain, Google Safe Browsing classifies it as phishing, and it appears on two independent security blocklists, including PhishDestroy and PhishingDB. The domain is currently offline, reducing immediate risk to end users. However, residual threats persist due to the transient nature of phishing infrastructure. Historical DNS records and cached content may still pose risks if accessed via outdated links or search engine results. Organizations are advised to update web filtering rules to block the domain and its resolved IP, monitor for related subdomains or redirects, and alert users to potential credential exposure. While the site is inactive, threat actors may redeploy similar infrastructure under different domains, necessitating continuous monitoring of hosting patterns and certificate issuance trends.