sage-dusk-77ba3d[.]netlify[.]app

This domain, sage-dusk-77ba3d.netlify.app, is identified as a platform for credential theft, specifically targeting users of the Netflix streaming service. The threat poses an elevated risk level due to its sophisticated impersonation techniques and the potential for significant personal data compromise.

Analysis indicates that the domain is flagged by 19 out of 95 security vendors on VirusTotal, suggesting a moderate level of consensus among security researchers regarding its malicious nature. The domain is registered through Netlify and uses an SSL certificate issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1. The IP address 18.208.88.157, associated with AS14618 Amazon.com, Inc., further contextualizes the infrastructure used. The domain appears on 2 security blocklists, namely PhishDestroy and PhishingDB, indicating its involvement in known phishing campaigns.

If users have visited this domain, they are advised to immediately change their Netflix account passwords and enable two-factor authentication (2FA) for additional security. Additionally, users should monitor their account activity for any unauthorized access or transactions and consider contacting their financial institutions if sensitive information was potentially compromised. It is also recommended to update security software and perform a full system scan to ensure no residual malware remains.