revebail[.]netlify[.]app

This domain, revebail.netlify.app, operates as a brand impersonation phishing site targeting BCE-Bell customers. The page mimics legitimate Bell login portals, presenting users with a fraudulent interface titled 'Bell' to harvest credentials or other sensitive account information. Analysis indicates the infrastructure was designed to deceive users into believing they are interacting with an official Bell service, increasing the likelihood of successful credential theft or unauthorized account access. Infrastructure analysis reveals the domain was flagged by 14 out of 95 security vendors on VirusTotal, indicating a moderate but elevated detection rate. The site was hosted on Netlify, a legitimate platform often abused for phishing due to its free hosting capabilities. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), resolves to IP address 98.84.224.111, located in the US under AS14618 (Amazon.com, Inc.). The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is currently offline. Users who visited revebail.netlify.app should immediately assume their credentials or personal information may have been compromised. It is recommended to change passwords for any accounts accessed after visiting the site, enable multi-factor authentication where available, and monitor accounts for unauthorized activity. If financial or payment details were entered, affected users should contact their financial institution to report potential fraud. Additionally, scanning the device used to access the site for malware is advised to rule out secondary compromise.