ba90ef3b49010f108d66a1--extraordinary-pastelito-8d4c5e[.]netlify[.]app

This domain, ba90ef3b49010f108d66a1--extraordinary-pastelito-8d4c5e.netlify.app, is flagged as a high-risk generic phishing threat specializing in credential harvesting. Analysis indicates the site mimics a login portal without targeting a specific brand, suggesting a broad-spectrum phishing campaign. The page title matches the domain name exactly, a common tactic to avoid immediate suspicion while luring victims into entering sensitive credentials. No explicit crypto drainer or branded impersonation components were identified, but the infrastructure aligns with opportunistic phishing operations. Infrastructure analysis reveals the following technical indicators: the domain was created on March 22, 2026, and is registered through Netlify. It resolves to the IP address 63.176.8.218, hosted on AWS EC2 in the eu-central-1 region (Germany). The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), a legitimate provider often exploited by threat actors to lend credibility. VirusTotal detection shows 1 out of 95 security vendors flagging the domain, while it appears on one additional security blocklist. Google Safe Browsing status was not explicitly provided, but the low detection rate suggests either recent deployment or evasion techniques. As of the latest verification, the domain remains active and unmitigated, posing a persistent risk to unsuspecting users. The hosting provider has not taken action, and the SSL certificate remains valid, further enabling the phishing operation. Organizations are advised to block the domain and IP at the network level, while users should avoid interacting with any login prompts from this source. Given the domain's recent creation and low initial detection, monitoring for related infrastructure or similar naming patterns is recommended to preempt potential follow-up campaigns.