taupe-custard-6d4b9e[.]netlify[.]app

Analysis of taupe-custard-6d4b9e.netlify.app, observed on July 27 2026, confirms that the domain is actively used for phishing. The site appears on one public security blocklist and is listed by PhishDestroy as blocked. VirusTotal scans show that 8 of 91 security vendors have flagged the domain as malicious, indicating a non‑trivial detection consensus.

DNS resolution returns a single IPv4 address, 35.157.26.135, which is owned by Netlify’s hosting infrastructure; the domain was provisioned through Netlify, and the authoritative name server information could not be retrieved (NS_NOT_FOUND). No additional intelligence such as page title, SSL certificate details, or brand targeting has been released, so the exact phishing lure remains unknown. The limited visibility into the underlying web content creates uncertainty about the specific credential‑stealing vector employed, but the presence on a blocklist and multiple vendor detections provide sufficient confidence to treat the domain as high‑risk.

Defensive operators should immediately block outbound connections to 35.157.26.135 and add taupe-custard-6d4b9e.netlify.app to URL filtering policies. Monitoring for any new DNS records or changes in the hosting provider’s IP range is advised, as Netlify‑hosted phishing sites can be rapidly redeployed. Organizations using web‑proxy or secure web gateway solutions should ensure the domain is denied, and incident response teams should consider the domain as a potential indicator of compromise if related phishing emails are observed.