shaw-webmail-1482[.]netlify[.]app

Shaw-webmail-1482.netlify.app is a high-risk brand impersonation phishing domain currently active and targeting Shaw customers. The threat type is brand impersonation, where attackers create a fraudulent login page to steal credentials. The page title is 'Sign in - Shaw', and no specific drainer kit has been identified, but the site mimics the legitimate Shaw webmail interface to trick users into entering their email and password.

Technical indicators are severe: VirusTotal reports a 21/95 detection rate among security vendors, meaning over a fifth of scanners flag the domain as malicious. The domain resolves to IP address 98.84.224.111 and is registered through Netlify. The SSL certificate is issued by DigiCert Inc using the DigiCert Global G2 TLS RSA SHA256 2020 CA1, which lends false legitimacy to the phishing page. The domain appears on 1 security blocklist. No Google Safe Browsing status was provided, but the high VT score and blocklist presence indicate significant risk.

As of the latest check, the phishing page remains active and accessible. PhishDestroy recommends immediate avoidance: do not visit the domain, and if credentials were entered, change passwords immediately and enable two-factor authentication on your Shaw account. The remaining risk is high because the site is still online and could be used to harvest more victims. Users should always verify the authenticity of login pages by directly typing the official URL (e.g., shaw.ca) rather than clicking links in emails or messages.