marvelous-sfogliatella-f320f8[.]netlify[.]app

This domain, marvelous-sfogliatella-f320f8.netlify.app, is currently flagged as a high-risk webmail phishing site. Analysis indicates it impersonates legitimate email login portals, likely targeting corporate or personal credentials under the guise of a Webmail Sign-in interface. The domain remains active as of the latest verification, posing an ongoing threat to users who may be deceived into entering sensitive authentication details. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Name.com, Inc., and is hosted on Netlify’s platform. It resolves to the IP address 35.157.26.135, located in Germany under Amazon.com, Inc.’s AS16509. The SSL certificate is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 intermediate. Detection metrics show 21 of 95 security vendors on VirusTotal flagging the domain as malicious, while Google Safe Browsing explicitly categorizes it as phishing. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, further corroborating its malicious intent. Current assessment confirms the domain remains operational, continuing to host the fraudulent Webmail Sign-in page. Organizations and individuals are advised to block access to this domain at the network level, including the associated IP address 35.157.26.135. Endpoint protection systems should be updated to recognize the domain and its SSL certificate thumbprint as indicators of compromise. Users who may have interacted with the site should be instructed to reset credentials immediately, particularly if login details were entered. Monitoring for related phishing campaigns leveraging similar Netlify-hosted subdomains is recommended, given the platform’s frequent exploitation for credential harvesting operations.