genuine-belekoy-b60866[.]netlify[.]app

On July 24, 2026, the domain genuine-belekoy-b60866.netlify.app was observed hosting a generic phishing campaign. The site resolved to the IP address 35.157.26.135, which is assigned to Amazon.com, Inc. (AS16509) and geolocated to Germany. The hosting environment is identified as Netlify, confirmed by the presence of Netlify‑specific headers and the SSL certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1. The certificate chain includes DigiCert Inc, and the site enforces HTTP Strict Transport Security (HSTS). An HTTP request returned a 404 status code and the page title “Site not found”, indicating that the malicious content has been removed or the site is currently offline.

Reputation data show that Google Safe Browsing flagged the domain for social engineering, and PhishDestroy listed it as blocked. VirusTotal scanned the domain and 10 of 93 security vendors reported it as malicious, while the domain appears on one public blocklist. The registrar information shows the domain was provisioned through Netlify, and the authoritative nameservers could not be resolved (NS_NOT_FOUND). No additional intelligence such as specific credential‑stealing pages or targeted brands was available at the time of analysis.

Uncertainty remains regarding the exact phishing payload, the targeted victim profile, and whether the domain was part of a larger infrastructure. Defenders should continue to block the domain at perimeter filters, update URL and hash‑based threat feeds, and monitor the associated IP address for any re‑activation. Because the site is presently offline, investigators should preserve the historical DNS and SSL data for correlation with future incidents. Ongoing vigilance is advised, especially for assets that rely on Netlify hosting, to detect similar abuse.