dancing-tapioca-a460d0[.]netlify[.]app

The domain dancing-tapioca-a460d0.netlify.app was registered through Netlify and has been active since its creation on May 08, 2018. Current infrastructure analysis shows the hostname resolves to the IPv4 address 63.176.8.218, which is the hosting endpoint used by multiple reported phishing campaigns. VirusTotal reports that 16 of 91 scanned security engines flag the domain as malicious, indicating a moderate to high level of detection confidence across independent scanners. The site is listed on three public security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services.

Google Safe Browsing classifies the domain as a social engineering threat, reinforcing the suspicion of credential‑harvesting activity. No publicly available page title or content snapshot has been captured, so the exact lure or targeted brand cannot be confirmed at this time. The absence of a publicly posted SSL certificate detail leaves the TLS configuration unverified, although Netlify typically provides automated HTTPS. Defenders should add the domain and its resolved IP 63.176.8.218 to outbound and inbound deny lists, monitor DNS queries for this hostname, and ensure that any web‑filtering solutions incorporate the known blocklist entries.

Email security gateways should treat messages containing this domain as malicious, and users should be warned against clicking links that point to this Netlify sub‑domain. Continuous re‑scanning on VirusTotal and periodic checks against Google Safe Browsing are advised to capture any changes in detection scores. Given the high risk rating, active status, and multiple independent detections, the domain should be treated as a confirmed phishing infrastructure until further analysis proves otherwise.