capable-moonbeam-952d95[.]netlify[.]app

Analysis on July 29, 2026 assesses capable-moonbeam-952d95.netlify.app as an active generic phishing infrastructure. The domain was created on May 08, 2018 and is hosted on Netlify, resolving to the IPv4 address 35.157.26.135. VirusTotal records indicate that 4 out of 91 scanning engines have raised detections against the domain, confirming malicious behavior. Independent community blocklists have listed the domain on two separate deny lists, and it is currently blocked by the PhishDestroy and ScamSniffer filtering services. The combination of vendor detections, blocklist presence, and active blocking suggests a high likelihood of phishing content being served, consistent with the elevated risk rating.

Publicly available intelligence does not disclose the HTTP response code, TLS certificate details, or the exact page title presented by the site, leaving the content of the page unverified. No additional contextual data such as associated malware families, compromised credentials, or victim reports have been published. Consequently, the precise targeting vector and payload characteristics remain uncertain. Defenders should prioritize the domain for immediate blocking at perimeter and endpoint controls, ensuring that DNS filtering solutions incorporate the known IP address 35.157.26.135 and the domain name itself. Continuous monitoring of VirusTotal submissions and blocklist updates is advised to capture any escalation in detection counts.

Where possible, network traffic to the host should be logged and inspected for credential harvesting patterns. Given the lack of TLS information, enforcing HTTPS inspection where possible is recommended to detect any credential exfiltration. Organizations employing threat intelligence platforms should ingest the domain indicator and correlate with internal logs to identify any prior contacts. If evidence of successful credential capture emerges, a coordinated breach response should be launched.