nodedfi[.]netlify[.]app

Analysis of the domain nodedfi.netlify.app indicates it was a generic phishing page hosted on Netlify infrastructure, now offline. The domain was registered on February 21, 2026, through Name.com, Inc., and resolved to an IPv6 address 2a05:d014:58f:6200::258, associated with Amazon.com, Inc. AS16509 in Germany. Nameservers were configured as dns1.p01.nsone.net through dns4.p01.nsone.net. At the time of assessment, the domain returned an HTTP 404 status with the page title 'Site not found,' suggesting it was either taken down or never fully deployed.

The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), remained valid, but this does not indicate malicious activity on its own. The domain appeared on three security blocklists, including PhishDestroy, MetaMask, and SEAL, signaling prior detection as a potential threat. No specific brand impersonation or phishing kit was identified in the available data, and the exact content of the page remains unanalyzed. Technologies detected include Netlify hosting and HTTP Strict Transport Security (HSTS).

While 93 vendors scanned the domain via VirusTotal, none currently flag it as malicious; however, the absence of detections does not confirm safety. Defenders should treat this domain as a confirmed phishing indicator, particularly given its presence on multiple blocklists and association with known malicious infrastructure. Further investigation into related domains or hosting patterns is recommended to identify potential linked threats.