famous-peony-e0bb75[.]netlify[.]app

The domain famous-peony-e0bb75.netlify.app has been identified as a high-risk credential harvesting phishing site targeting users through fraudulent login interfaces. Analysis indicates this infrastructure was designed to impersonate legitimate services, likely financial institutions or corporate portals, to harvest sensitive authentication credentials. The domain is currently offline, though its prior activity remains a documented threat vector. Infrastructure analysis reveals the domain was registered through Name.com, Inc. under the Netlify platform on February 21, 2026, an anomalous future date suggesting potential domain spoofing or registrar manipulation. It resolves to the IP address 18.208.88.157, hosted on Amazon.com, Inc. infrastructure (AS14618) in the United States. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides encrypted connections but does not mitigate the underlying phishing threat. Detection metrics show 18 of 95 security vendors on VirusTotal flagged this domain as malicious, while it appears on one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. The page title 'Site not found' suggests either a takedown or deliberate evasion of automated detection systems. Current status confirms the domain has been taken offline, though residual risk persists for users who may have interacted with it during its active period. Organizations and individuals are advised to implement the following mitigations: block the domain and associated IP 18.208.88.157 at the network perimeter, revoke any credentials potentially exposed to this infrastructure, and monitor for unauthorized access attempts. Security teams should review logs for connections to the domain or IP and correlate with authentication anomalies. Given the high-risk classification, affected entities should conduct a thorough audit of systems that may have accessed this domain prior to its deactivation.