phenomenal-pegasus-dde9a7[.]netlify[.]app

The domain phenomenal-pegasus-dde9a7.netlify.app has been identified as a credential theft phishing site, currently active and posing a high risk to users. This domain is hosted on Netlify and was registered on February 21, 2026, through Name.com, Inc. Despite displaying a 'Site not found' page title, the domain remains operational and is likely used to harvest login credentials through deceptive means.

Analysis reveals that this domain was flagged by 16 out of 95 VirusTotal security vendors, indicating widespread recognition of its malicious nature. It also appears on one security blocklist. The domain resolves to IP address 18.208.88.157, and its trust score is notably low due to the high number of vendor detections. The combination of recent registration and active status suggests an ongoing campaign that may target users through phishing emails or malicious links.

Given the active status and high risk level, immediate action is recommended. Users should block access to this domain at the network level and educate employees about the dangers of clicking on unsolicited links. Monitoring for any related domains or variations is also advised to prevent future threats. PhishDestroy recommends adding this domain to blocklists and reporting it to relevant threat intelligence platforms.