699a26ca1eae9cec8700576e--glistening-platypus-505378[.]netlify[.]app

The domain 699a26ca1eae9cec8700576e--glistening-platypus-505378.netlify.app was registered on February 23, 2026 through Name.com, Inc. and is hosted on Amazon’s infrastructure (AS16509) in Germany, resolving to IP address 18.208.88.157. The site was configured with Netlify services and enforces HSTS, presenting a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate. An HTTP request to the site returns a 404 status, indicating the content is no longer accessible. Threat intelligence records show the site was used for a high‑risk brand‑impersonation campaign targeting the French tax authority (Impots Gouv) and is classified as banking phishing.

The page title observed during the brief hosting period was "Particuliers | authentification," aligning with the claimed target. Detection metrics indicate the domain appears on one security blocklist and has been blocked by PhishDestroy. Google Safe Browsing flags it for social engineering, and VirusTotal analysis reports 21 of 93 scanning engines flagging the domain as malicious. The combination of rapid domain creation, use of a reputable hosting provider, a valid SSL certificate, and the presence of a targeted page title suggests a deliberate attempt to lend credibility to the fraudulent page.

While the site is currently offline, the infrastructure—particularly the Amazon‑hosted IP and Netlify deployment—may be reused for future impersonation attempts. Defenders should continue to monitor the associated IP range for similar Netlify‑hosted domains, enforce blocklists that include this domain, and educate users about unsolicited requests referencing Impots Gouv login portals. Incident response teams should also consider adding the domain to internal deny‑list rules and reviewing any outbound traffic that may have contacted the IP before the takedown.