transfer-bep-20[.]netlify[.]app

Analysis of transfer-bep-20.netlify.app, first observed on May 08 2018, indicates that the domain is actively being used for phishing. The site is hosted on Netlify, as shown by the registrar information, and resolves to the IPv4 address 35.157.26.135. VirusTotal has recorded 14 positive detections out of 91 scanned security vendors, representing a 15.4% positive rate and confirming that a significant subset of commercial scanners classify the domain as malicious. The domain appears on two independent security blocklists and is explicitly blocked by the PhishDestroy and ScamSniffer services, both of which update in near real‑time, reinforcing the phishing classification.

The risk rating assigned is elevated, and the current status is active, meaning the infrastructure remains reachable. No additional data such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, or content analysis have been published, so the exact phishing vector, page title, or targeted brand cannot be described at this time. Given the age of the registration (over eight years) the domain may have been repurposed, a pattern observed in long‑standing hosting services. Defenders should block traffic to 35.157.26.135 and add transfer-bep-20.netlify.app to outbound and inbound deny lists across firewalls, proxy servers, and DNS filtering solutions.

Security monitoring should include alerts for any DNS queries or HTTP requests to this domain, and incident response teams should investigate any credential submissions that correlate with the domain’s activity window. Organizations may also consider sink‑holing the IP address to gather additional telemetry and ensure that any user‑submitted credentials are rotated. Continuous re‑evaluation is advised as further threat intelligence becomes available.