tdj-rig-usf-swt-tss-wcs-amfu[.]netlify[.]app

This domain is flagged as a high-risk generic phishing threat designed to harvest credentials through a deceptive password protection interface. Analysis indicates the site mimics authentication portals to trick users into submitting sensitive login details, which are then exfiltrated to attacker-controlled infrastructure. The specific threat type involves a fake login mechanism, commonly used in credential theft campaigns targeting both corporate and personal accounts. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain, registered through Netlify, resolves to IP address 63.176.8.218, hosted on AWS EC2 in the eu-central-1 region (Germany). The SSL certificate is issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, a common but abused authority in phishing operations. The domain was created on March 22, 2026, an anomalous future date suggesting potential spoofing or misconfiguration. Detection engines flagged the domain on VirusTotal with 13 out of 95 security vendors marking it as malicious. Three independent security blocklists—PhishDestroy, MetaMask, and SEAL—have actively blocked this domain, reinforcing its classification as a confirmed phishing resource. The page title, 'Password Protection,' further corroborates the credential harvesting intent. Mitigation requires immediate action to prevent credential exposure. Users who may have interacted with this domain should invalidate any entered credentials across all platforms, particularly if password reuse is suspected. Network administrators are advised to block the domain and its resolving IP (63.176.8.218) at the perimeter firewall or DNS level. Security teams should monitor for outbound connections to the domain or IP in logs, as such activity may indicate successful phishing attempts. Given the domain's active status and high detection rate, organizations should treat any access attempts as potential security incidents and initiate appropriate response protocols, including user awareness training on recognizing fake login portals.