auth0-ms-doc[.]netlify[.]app

The domain auth0-ms-doc.netlify.app is currently classified as a high‑risk generic phishing infrastructure and remains active as of the report date, August 03, 2026. Registration details show that the domain was provisioned through Netlify, a widely used static‑site hosting provider, which does not inherently imply malicious intent but indicates the attacker leveraged a reputable platform to obscure the origin of the malicious payload. The site appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one external threat‑intel source has taken defensive action against it.

Google Safe Browsing has flagged the domain for social engineering, a categorisation that aligns with the generic phishing designation supplied in the intelligence brief. VirusTotal analysis reveals that 13 of 91 security vendors have raised detections against the domain, suggesting a moderate level of vendor consensus on its malicious nature, though the remaining vendors have not flagged it. No additional technical artefacts such as IP address, ASN, country, SSL certificate details, HTTP response codes, or page title have been disclosed, leaving those aspects of the infrastructure unverified at this time.

Defenders should prioritize immediate containment measures: add the domain to local deny lists, enforce outbound DNS filtering, and monitor for any traffic patterns that reference Netlify‑hosted subdomains matching the observed naming convention. Continuous re‑evaluation is advised, as further analysis of the hosted content or subsequent vendor submissions could refine the threat profile.