dancing-froyo-1eba9c[.]netlify[.]app

The domain dancing-froyo-1eba9c.netlify.app was created on June 20 2026 and currently resolves to the IPv6 address 2a05:d014:58f:6200::258 hosted in Germany by AS16509 Amazon.com Inc. It serves an active page with HTTP status 200 titled Enterprise Document Services Portal and has been categorized as generic phishing with high risk level. The infrastructure is operated through Netlify with HSTS enabled and carries an SSL certificate issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain. Google Safe Browsing has flagged the domain for SOCIAL_ENGINEERING while VirusTotal reports detections from 15 of 95 vendors and Gridinsoft records a trust score of 0 out of 100.

Nameservers are listed as NS_NOT_FOUND and the domain appears on one security blocklist with explicit blocking recorded by PhishDestroy. Registration occurred via Netlify and the site remains reachable as of July 12 2026 approximately three weeks after creation. These technical markers align with known patterns of short-lived Netlify-hosted phishing pages that mimic enterprise document portals to capture credentials.

Analysis indicates the precise phishing kit in use and any specific target organization beyond the portal title remain undetermined from available data. The IPv6 endpoint and DigiCert certificate chain provide stable hosting identifiers that can be monitored for additional subdomains or rapid redeployment on the same provider.

Defenders should add the domain and its IPv6 address to blocklists enforce DNS sinkholing and scan internal logs for connections or redirects toward dancing-froyo-1eba9c.netlify.app. User awareness notices regarding unsolicited document portal links combined with continuous monitoring of Netlify-hosted domains sharing similar naming patterns are recommended to limit exposure.