mail-sco-gov-pk[.]netlify[.]app

The domain mail-sco-gov-pk.netlify.app is a high-risk generic_phishing site impersonating the Zimbra email service. This domain is designed to deceive users into providing sensitive information, potentially leading to credential theft or further malicious activities. No specific crypto drainer kit has been identified, but the presence of a fake login page poses significant risks to unsuspecting visitors.

Infrastructure analysis reveals that the domain is registered through Netlify and resolves to the IP address 63.176.8.218, which is located in Germany (DE) and associated with AS16509 Amazon.com, Inc. The SSL certificate is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1. On VirusTotal, 17 out of 95 security vendors flag this domain as malicious. The domain appears on 2 security blocklists, including PhishDestroy and PhishingDB, indicating a widespread recognition of its malicious nature.

The domain remains active as of the latest analysis, posing ongoing risks to potential victims. Immediate response actions include blocking the domain at the network or firewall level and educating users about the risks of fake login pages. Despite the partial blockage, the domain's presence on major services and its high VirusTotal detection rate suggest a remaining risk that should be monitored and mitigated.