project-io-suites[.]netlify[.]app

This domain, project-io-suites.netlify.app, is flagged as an active credential harvesting phishing infrastructure targeting users of productivity suite services. Analysis indicates the site mimics legitimate login portals to capture authentication credentials, session tokens, or other sensitive user data. The domain is designed to exploit trust in widely used enterprise software, potentially leading to unauthorized account access, data exfiltration, or further lateral movement within compromised networks. Infrastructure analysis reveals the domain is hosted on Netlify’s platform and resolves to the IP address 35.157.26.135. The SSL certificate is issued by DigiCert Inc, providing a veneer of legitimacy to unsuspecting users. As of the latest investigation, the domain has not been flagged by any of the 95 security engines on VirusTotal, indicating it may still be in the early stages of deployment or evading detection through obfuscation techniques. No blocklist entries or prior reports were identified, further suggesting its novelty in the threat landscape. Users who have visited project-io-suites.netlify.app or entered credentials on the site should immediately revoke any active sessions associated with the affected account. Reset passwords using a secure, unrelated device and enable multi-factor authentication if not already active. Monitor the account for unauthorized access or suspicious activity, including unexpected login attempts or changes to account settings. Organizations should consider isolating affected endpoints and reviewing network logs for connections to 35.157.26.135 or related subdomains. If credentials were entered, assume they are compromised and rotate them across all services where they may have been reused.