rulekeeper-auditchecking-fds1810c[.]netlify[.]app

This domain, rulekeeper-auditchecking-fds1810c.netlify.app, is actively engaged in fake login phishing activities. The threat poses a significant risk as it attempts to deceive users into providing their login credentials, which can then be used for unauthorized access to sensitive accounts and systems. Such fake login pages are often designed to mimic legitimate websites, making them appear trustworthy to unsuspecting users.

Analysis indicates that 15 out of 95 security vendors on VirusTotal have flagged this domain, suggesting a high level of suspicion among cybersecurity professionals. The domain is registered through Netlify, a popular web hosting service, which can sometimes be abused by threat actors due to its ease of use and credibility. Furthermore, the domain currently appears on two known security blocklists: PhishDestroy and PhishingDB. The IP address 35.157.26.135 is located in Germany and belongs to AS16509 Amazon.com, Inc., which may indicate the use of cloud infrastructure to host the phishing site. The SSL certificate is issued by DigiCert Inc, using the DigiCert Global G2 TLS RSA SHA256 2020 CA1, adding a layer of perceived security that can be exploited to gain user trust.

If users have visited this domain, they should immediately change their passwords for any accounts that may have been compromised. It is recommended to enable multi-factor authentication (MFA) for an added layer of security. Users should also monitor their account activity for any unauthorized transactions or changes. Reporting the incident to their organization's IT security team and to the relevant service provider is advised to ensure that the threat is addressed and that other potential victims are alerted.