illustrious-yeot-fc6450[.]netlify[.]app

This domain, illustrious-yeot-fc6450.netlify.app, was identified as a credential harvesting phishing site designed to mimic legitimate login portals for financial institutions, corporate email services, or cloud storage providers. The infrastructure was configured to capture entered usernames, passwords, and multi-factor authentication codes, then relay them to attacker-controlled endpoints for immediate exploitation or resale. Analysis of historical snapshots reveals cloned interfaces of regional banks and SaaS platforms, with form submissions routed through obfuscated JavaScript and proxy servers to evade detection. Infrastructure analysis provides multiple indicators of malicious intent. The domain was registered on February 22, 2026, through Name.com, Inc., and hosted on Amazon Web Services (AS16509) at IP 63.176.8.218. Security vendors flagged the domain on VirusTotal with 22/95 detections, while Google Safe Browsing classified it as phishing. The site appears on one security blocklist and was proactively blocked by enterprise phishing protection systems. The SSL certificate, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, follows common phishing patterns of using valid certificates to appear legitimate. Users who visited illustrious-yeot-fc6450.netlify.app or entered credentials on any page should assume compromise. Immediately reset passwords for all accounts accessed from the same browser session, prioritizing financial, email, and single-sign-on services. Enable multi-factor authentication using app-based or hardware tokens rather than SMS or email-based codes. Monitor accounts for unauthorized transactions, password change notifications, or unfamiliar device logins. If corporate credentials were exposed, report the incident to internal security teams for credential rotation and endpoint scanning. Clear browser cache and stored credentials to prevent automated replay attacks from residual session tokens.