verdant-dodol-662079[.]netlify[.]app

Verdant-dodol-662079.netlify.app is currently hosted on Netlify’s shared infrastructure (IP 35.157.26.135). The domain resolves correctly and remains active as of the report date. VirusTotal has recorded nine positive detections out of ninety‑one scanned security vendors, indicating that multiple scanners have identified malicious behavior associated with the host. Google Safe Browsing classifies the site under social engineering, and the PhishDestroy feed has already added the domain to its blocklist.

Additionally, one external security blocklist includes the domain, reinforcing the consensus that the site is being used for malicious purposes. The registrar information shows the domain was provisioned through Netlify, which is consistent with the observed hosting IP. No nameserver records were returned (NS_NOT_FOUND), which is typical for Netlify‑provided domains that rely on their internal DNS resolution. The available evidence does not disclose the exact content or the specific phishing lure employed, so the precise target brand or credential‑stealing technique remains uncertain.

However, the convergence of multiple independent detections, a Google Safe Browsing flag, and active blocklist listings justify a high‑risk classification. Defenders should block the domain at perimeter firewalls, DNS resolvers, and endpoint protection solutions. Security teams should monitor Netlify‑hosted domains for similar patterns and consider adding the IP address 35.157.26.135 to internal deny lists, while continuing to collect threat intel on any emerging payloads or command‑and‑control endpoints that may be associated with this infrastructure.