gorgeous-puffpuff-d1509c[.]netlify[.]app

This domain, gorgeous-puffpuff-d1509c.netlify.app, presents a high-risk phishing threat designed to impersonate a Microsoft Excel shared document interface. Analysis of the page title, 'Excel :: Shared Document,' indicates an attempt to deceive users into believing they are accessing a legitimate cloud-stored spreadsheet. The objective is likely credential harvesting, where victims are prompted to enter login credentials under the pretense of viewing or editing the document. Such campaigns often target corporate or personal users who rely on cloud-based productivity tools, exploiting trust in familiar brand interfaces to extract sensitive authentication details. Technical indicators confirm the malicious nature of this domain. As of the latest assessment, 18 out of 95 security vendors on VirusTotal have flagged the domain as malicious, reflecting a consensus among detection engines regarding its phishing intent. The domain is registered through Netlify, a platform commonly used for hosting static websites, which has been leveraged in this case to deploy the fraudulent page. Infrastructure analysis reveals the domain resolves to the IP address 63.176.8.218, located in Germany under AS16509, an autonomous system operated by a major cloud provider. The domain appears on at least one security blocklist and has been explicitly labeled as phishing by Google Safe Browsing. Additionally, the SSL certificate, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, does not mitigate the threat, as phishing sites frequently employ valid certificates to appear legitimate. Users who have visited gorgeous-puffpuff-d1509c.netlify.app or interacted with its content should take immediate remedial actions. If credentials were entered, they must be changed without delay across all platforms where the same or similar passwords were used. Multi-factor authentication should be enabled on all critical accounts to mitigate the risk of unauthorized access. System scans using updated security tools are recommended to detect any potential secondary infections or data exfiltration. Network administrators should block the domain and its associated IP address within organizational firewalls and proxy servers to prevent further exposure. Reporting the domain to relevant security teams or threat intelligence platforms can aid in broader mitigation efforts.