merry-fox-f66caa[.]netlify[.]app

This domain, merry-fox-f66caa.netlify.app, was created on 15 November 2025 and is hosted on Netlify infrastructure. The site currently returns HTTP 404 with the page title “Site not found”, indicating that the content is not publicly reachable at the time of analysis. SSL inspection shows a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate issued by DigiCert Inc, confirming the use of a valid public‑trusted certificate. Network resolution points to the IP address 35.157.26.135, which belongs to Amazon.com, Inc. (AS16509) and resolves to a location in Germany.

VirusTotal reports that 19 of 95 security vendors have flagged the domain, providing independent confirmation of malicious activity. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, reinforcing the elevated risk assessment. Detected technologies include Netlify hosting, HTTP Strict Transport Security (HSTS), and the DigiCert certificate chain. Nameserver data is unavailable (NS_NOT_FOUND), and the registrar record shows the domain was provisioned through Netlify’s automated registration service.

Given the combination of vendor detections, blocklist presence, and the phishing classification, defenders should add the domain to network‑level deny lists, monitor the associated IP for any further abusive traffic, and ensure endpoint protection solutions are updated with the latest indicator feeds. Because the site is offline, additional content analysis is not possible, and the exact phishing payload or target page cannot be confirmed. Continuous observation of the hosting provider and periodic re‑scanning are recommended to detect any future re‑activation.