steady-rugelach-5e850b[.]netlify[.]app

Analysis of steady-rugelach-5e850b.netlify.app indicates that the domain is actively used for a generic phishing campaign. The site resolves to the IPv4 address 63.176.8.218, which is hosted on Netlify's infrastructure. Registration details show the domain was provisioned through Netlify, and the authoritative nameserver information is not publicly disclosed (NS_NOT_FOUND). VirusTotal has recorded 14 detections out of 91 scanned security vendors, suggesting a notable level of malicious classification across multiple engines.

The domain is listed on two external blocklists and is explicitly flagged by Google Safe Browsing for social engineering, reinforcing the phishing assessment. Additional threat intelligence sources, PhishDestroy and OpenPhish, have added the domain to their blocklists, confirming that it is recognized by independent anti‑phishing feeds. The current operational status remains active, meaning the malicious payload or credential‑harvesting page is still reachable. The observable evidence is limited to infrastructure and reputation signals; no page‑level analysis, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact content of the hosted page uncertain.

Defenders should prioritize blocking network traffic to the IP address 63.176.8.218 and enforce domain‑level deny rules for steady-rugelach-5e850b.netlify.app across perimeter and endpoint protection solutions. Continuous monitoring of Netlify‑hosted subdomains is advisable, as the provider's shared hosting model can allow rapid re‑deployment of similar phishing pages. Organizations using Google Safe Browsing or threat‑intel feeds should ensure that alerts from PhishDestroy and OpenPhish are integrated into their security orchestration pipelines to trigger automated remediation. Given the multiple vendor detections and blocklist presence, the risk rating remains high, and immediate containment actions are recommended.