moonlit-licorice-6dba0d[.]netlify[.]app

The domain moonlit-licorice-6dba0d.netlify.app is a brand impersonation phishing threat specifically targeting Rackspace customers. It was identified as an active phishing site and has since been taken offline. The page title, 'Rackspace Webmail: Hosted Email for Business', was designed to deceive users into believing they were accessing a legitimate Rackspace email login portal.

PhishDestroy's analysis reveals that this domain was flagged by 17 out of 95 VirusTotal vendors, indicating a high level of malicious consensus. It was registered through Netlify and resolved to the IP address 35.157.26.135. The site appeared on two security blocklists, and its SSL certificate was issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1, which may have lent an air of false legitimacy. Despite the certificate, the domain's sole purpose was credential theft.

Given that the domain is now offline, the immediate risk to users is mitigated. However, PhishDestroy recommends that Rackspace customers who may have interacted with this site change their passwords immediately and enable multi-factor authentication. Users should always verify URLs carefully and avoid clicking on unsolicited email links claiming to be from Rackspace. Monitoring accounts for suspicious activity is also advised.