formstea[.]netlify[.]app

This domain, formstea.netlify.app, is currently flagged as a high‑risk generic phishing site. The infrastructure analysis shows the domain was provisioned through Netlify, a popular static‑site hosting service, and resolves to the IP address 35.157.26.135. Netlify’s default DNS configuration is in use; the nameserver information is not publicly available (NS_NOT_FOUND). The site has been added to at least one external blocklist and was also listed by the PhishDestroy community feed, indicating that defensive operators have already observed malicious activity originating from this host. VirusTotal scans have returned six positive detections out of ninety‑one participating scanners, confirming that multiple independent security engines have identified the domain as malicious.

The specific nature of the payload has not been publicly disclosed, and no page title, SSL certificate details, or HTTP response codes have been shared in the available intelligence. Consequently, the exact phishing vector—such as credential‑stealing forms or malware delivery—remains uncertain. Defenders should proactively block traffic to formstea.netlify.app at the network perimeter and update endpoint and browser protection suites with the latest threat intelligence feeds that include this indicator. Monitoring of DNS queries for the domain and its resolved IP 35.157.26.135 is recommended, as any resolution may indicate a compromised client attempting to contact the malicious host.

Organizations that rely on Netlify‑hosted assets should review access controls and consider restricting outbound connections to unknown Netlify subdomains unless explicitly required. Because the domain is still active, continuous re‑evaluation is necessary. Security teams are advised to query VirusTotal and other multi‑engine platforms for any new detections, and to incorporate the domain into automated blocklists used by firewalls, secure web gateways, and email security solutions.