endearing-uodatemailbox[.]netlify[.]app

PhishDestroy identifies endearing-uodatemailbox.netlify.app as an active credential harvesting scam impersonating a mailbox update portal. The domain weaponizes Netlify’s free hosting and DigiCert SSL to appear legitimate, while its backend drains harvested credentials to a rogue collector. No specific brand is mimicked in the observed payload, indicating a generic but high-efficiency trap aimed at harvesting email and password combinations for follow-on attacks.

This domain was flagged by 8 out of 95 VirusTotal security vendors. It resolves to IP 35.157.26.135, is registered through Netlify, and uses a DigiCert-issued SSL certificate. While creation and Google Safe Browsing status are not provided in the dataset, third-party blocklists already show multiple detections. The combination of free-tier hosting, valid SSL, and early-stage detection gaps makes this campaign particularly persistent and evasive.

As of the latest scan, the domain remains active and is actively propagating via email spam and social engineering lures. Immediate user action includes blocking the domain at DNS and proxy levels, removing any associated email messages, and resetting compromised credentials. The elevated risk profile persists due to the domain’s legitimate hosting infrastructure and SSL certificate, which lowers user suspicion. Remediation requires coordinated takedown via Netlify abuse channels and ISP-level blocking to neutralize the threat.