bespoke-arithmetic-50b562[.]netlify[.]app

Analysis of bespoke-arithmetic-50b562.netlify.app confirms it as a high-risk phishing domain targeting Rackspace, a known cloud and email hosting provider. The domain, now offline, was registered through Netlify and hosted on infrastructure belonging to Amazon.com, Inc. (AS14618) in the United States, resolving to IP address 98.84.224.111. Its SSL certificate, issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, was valid but does not mitigate the malicious intent. The page title, 'Rackspace Webmail: Hosted Email for Business,' directly aligns with the brand impersonation scam type identified by threat intelligence sources. The domain was flagged by 15 of 95 security vendors on VirusTotal, indicating broad detection consensus, and appears on at least one security blocklist (PhishDestroy).

Google Safe Browsing classified the site as engaging in social engineering, further corroborating its fraudulent nature. Scamadviser assigned a trust score of 1 out of 100, reflecting near-universal skepticism regarding its legitimacy. The HTTP status returned a 404 at the time of assessment, suggesting the site has been taken down or moved, though this does not eliminate residual risk. Nameservers dns1.p04.nsone.net and dns2.p04.nsone.net were in use, a configuration consistent with legitimate hosting but also commonly exploited by threat actors to blend in with benign traffic.

No evidence of a phishing kit or specific payload was provided, so the exact mechanics of credential harvesting remain unconfirmed. Defenders should treat this domain as compromised and block it at the DNS and network levels. Monitoring for related subdomains or re-registration under similar patterns (e.g., arithmetic-themed Netlify subdomains) is recommended. Given the offline status, further forensic analysis may be limited, but historical WHOIS or passive DNS data could reveal additional infrastructure links.