ephemeral-dodol-4ba5d6[.]netlify[.]app

ephemeral-dodol-4ba5d6.netlify.app is currently flagged as a high‑risk generic phishing site. The domain is hosted on Netlify and resolves to the IPv4 address 35.157.26.135. VirusTotal analysis shows that seven of ninety‑one scanning engines have reported malicious behavior, indicating that at least a subset of security vendors have observed phishing‑related artifacts associated with the domain. The domain appears on a single public blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the assessment of active malicious use.

Registrar information confirms the domain was provisioned through Netlify’s automated deployment platform, a common vector for abuse due to the ease of obtaining short‑lived, free hosting. No nameserver records were returned, which limits the ability to trace authoritative DNS configuration or to verify potential delegation anomalies. No additional metadata such as SSL certificate details, HTTP response codes, page title, or Safe Browsing verdicts were supplied, leaving the content and exact phishing lure undefined. Defenders should prioritize immediate containment by adding the domain and its resolved IP address to outbound filtering rules and internal blocklists.

Because the hosting provider is a shared platform, further investigation of other Netlify‑hosted assets that resolve to the same IP may reveal additional malicious actors. Continuous monitoring of threat‑intel feeds for updates to the blocklist status, VirusTotal detections, and any emerging reputation changes is advised. If possible, request takedown from Netlify, citing the documented phishing activity, to reduce the attack surface. Until more detailed payload or page analysis becomes available, the recommendation remains to treat any traffic to this domain as hostile and to enforce strict network‑level denial.