amazing-bunny-adeec8[.]netlify[.]app

The domain amazing-bunny-adeec8.netlify.app is an active credential theft phishing site that impersonates a legitimate Microsoft Excel shared document login page. This specific threat type involves tricking users into entering their email credentials under the guise of accessing a shared Excel file, a common tactic used to harvest login details for corporate or personal accounts. The site remains operational as of this report, posing an ongoing risk to anyone who encounters it.

Technical analysis reveals that the domain is hosted on Netlify's infrastructure, resolving to the IPv6 address 2a05:d014:58f:6200::259. It was flagged by 20 out of 95 VirusTotal security vendors as malicious, and Google Safe Browsing also flags it for phishing. The domain appears on one security blocklist. While the exact creation date is not provided, the registration through Netlify and current active status indicate a relatively recent deployment designed to evade initial detection.

PhishDestroy recommends that users avoid visiting this domain entirely. Organizations should block the domain and IP address at network level and educate employees about phishing lures involving shared document notifications. If any credentials were entered on this site, they must be changed immediately and IT security teams notified. Continuous monitoring for similar domains hosted on Netlify is advised.