phenomenal-florentine-a79a22[.]netlify[.]app

Analysis indicates that the domain phenomenal-florentine-a79a22.netlify.app is actively being used for a generic phishing campaign and is classified as high risk. Google Safe Browsing has flagged the site for social engineering, confirming that the URL is associated with deceptive practices intended to harvest credentials or personal information. The domain resolves to the IP address 63.176.8.218, which is hosted by Netlify, as evidenced by the registration information that lists Netlify as the registrar.

Infrastructure inspection shows that the domain’s nameserver records are unavailable (NS_NOT_FOUND), which may hinder rapid DNS‑based mitigation but does not affect the observed malicious activity. The domain appears on two reputable phishing blocklists—PhishDestroy and OpenPhish—demonstrating that multiple independent threat intelligence sources have identified and shared its malicious nature. VirusTotal analysis reports that 16 of 91 security vendors have flagged the domain, providing additional corroboration of its malicious status.

The current operational status is listed as active, indicating that the phishing infrastructure remains online and capable of targeting users. Defenders should immediately block network traffic to both the domain and its resolved IP address, update URL filtering policies to include the domain, and ensure that endpoint protection solutions are configured to recognize the associated Safe Browsing and blocklist indicators. Continuous monitoring of Netlify‑hosted assets and periodic re‑evaluation of the domain’s reputation are advised, given the dynamic nature of phishing campaigns.