cozy-tartufo-66895a[.]netlify[.]app

Analysis of the domain cozy-tartufo-66895a.netlify.app shows that it resolves to the IP address 35.157.26.135 and is hosted on Netlify’s infrastructure, as indicated by the registrar information. The domain was created on May 08, 2018, suggesting a long‑standing presence that may have been repurposed for malicious use. VirusTotal scans have recorded 16 detections out of 91 security‑vendor submissions, demonstrating that a notable minority of AV engines flag the site as malicious.

Additionally, the domain is listed on a security blocklist and has been actively blocked by the PhishDestroy service, reinforcing the perception of ongoing abuse. No public evidence of SSL certificate details, HTTP response codes, Safe Browsing status, or Open Threat Exchange (OTX) entries is currently available, indicating that those vectors have not been publicly disclosed or have not yet been captured by monitoring platforms. The lack of a known page title or brand targeting further limits attribution, but the combination of IP hosting, Netlify registration, detection counts, and blocklist presence is consistent with a credential‑harvesting operation.

Uncertainty remains regarding the exact phishing campaign content, the specific victim population, and whether the site currently serves active malicious payloads. Defenders should continue to block the domain at network perimeters, update URL filtering rules to include the host, and monitor Netlify‑hosted IP ranges for similar patterns. Threat‑intel teams are advised to corroborate the domain’s activity with endpoint logs, capture any network traffic to the IP address, and consider sharing any newly observed indicators with community blocklists to improve collective defenses.