vermillion-pasca-1a78d7[.]netlify[.]app

This domain is flagged as a high-risk credential phishing threat targeting users through a fraudulent Webmail Sign-in portal. Analysis indicates the page is designed to harvest login credentials by impersonating legitimate email authentication interfaces, a common tactic in targeted phishing campaigns. Infrastructure analysis reveals the domain vermillion-pasca-1a78d7.netlify.app is registered through Netlify and was created on May 19, 2026, an anomalous future date suggesting potential domain spoofing or misconfiguration. It resolves to IP address 63.176.8.218, located in AWS EC2 (eu-central-1), Germany. The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), which does not mitigate the malicious intent. VirusTotal reports 19 out of 95 security vendors flagging this domain as malicious. The domain appears on one security blocklist and is actively blocked by enterprise phishing detection systems. Google Safe Browsing categorizes this domain as phishing, and the page title explicitly reads 'Webmail Sign-in,' reinforcing its credential theft objective. Mitigation requires immediate blocking of the domain and its associated IP (63.176.8.218) at the network perimeter. Organizations should deploy email and web filtering rules to prevent user access to this domain. Endpoint detection systems should be updated to recognize the domain’s SSL certificate fingerprint and page title as indicators of compromise. Security teams are advised to monitor for credential reuse attempts from harvested data and conduct user awareness training emphasizing the risks of Webmail-themed phishing pages. If accessed, affected accounts must undergo password resets and multi-factor authentication enforcement.