escape22[.]netlify[.]app

escape22.netlify.app is presently listed as an active phishing site. The domain resolves to the IP address 35.157.26.135 and is hosted on Netlify infrastructure, as indicated by the registrar information. VirusTotal records show that one out of ninety‑one scanned security vendors flagged the domain, demonstrating at least a minimal detection by automated scanners. The site has been added to a public blocklist and is actively blocked by the PhishDestroy service, providing additional defensive coverage.

Nameserver queries returned no records (NS_NOT_FOUND), which may hinder some DNS‑based attribution methods. No further metadata such as SSL certificate details, HTTP response codes, or page titles are available in the current intelligence set, leaving the exact content of the site unverified. The limited detection footprint suggests that the phishing campaign is either newly deployed or deliberately low‑profile, but the presence on a blocklist and the single vendor detection confirm malicious intent. Defenders should enforce blocklist rules that include the domain and consider adding the resolved IP 35.157.26.135 to network‑level deny lists.

Continuous monitoring of VirusTotal and other reputation services is advised to capture any increase in detection count. Because the hosting provider is Netlify, organizations using SaaS‑based web hosting should review any outbound traffic to Netlify endpoints for anomalous patterns. Until more detailed page analysis is obtained, the domain should be treated as high‑risk and prevented from being accessed by end users.