bellsecure[.]netlify[.]app

This domain is flagged as a high-risk credential theft operation designed to harvest user login credentials through fraudulent account authentication pages. Analysis indicates the site presents a convincing replica of legitimate login portals, likely targeting unsuspecting users who enter sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. The threat type is specifically credential phishing, with no evidence of crypto drainer or brand impersonation of a single corporate entity at this time. Infrastructure analysis reveals the domain bellsecure.netlify.app is hosted on Netlify’s platform and resolves to the IP address 35.157.26.135, located in Germany under Amazon.com, Inc.’s AS16509. The SSL certificate is issued by DigiCert Inc, specifically a DigiCert Global G2 TLS RSA SHA256 2020 CA1, which does not inherently indicate malicious activity but is commonly leveraged by threat actors to lend false legitimacy. The domain is currently active and has been flagged by 13 out of 95 security vendors on VirusTotal, with a presence on at least one security blocklist. The page title, 'Sign in to your Account,' further supports the credential theft objective, as it mirrors typical login page nomenclature. Mitigation against this credential theft operation requires immediate action from both end users and network administrators. Users should avoid interacting with the domain and refrain from entering any credentials if the page has already been accessed. Network-level protections should include blocking the domain and its resolving IP address (35.157.26.135) at firewalls and DNS filtering solutions. Organizations should also monitor for any internal traffic to this domain or similar Netlify-hosted subdomains, as threat actors frequently rotate infrastructure. Multi-factor authentication (MFA) should be enforced to mitigate the impact of credential exposure, and users should be educated on recognizing fraudulent login pages, particularly those hosted on non-corporate domains or cloud platforms. Incident response teams should treat any credential submissions to this domain as compromised and initiate password resets for affected accounts.