tubular-chimera-76bbfa[.]netlify[.]app

Analysis of tubular-chimera-76bbfa.netlify.app indicates that the host is currently active and has been classified as a generic phishing site. The domain resolves to the IPv4 address 35.157.26.135, which is owned by Netlify and was provisioned through Netlify's hosting platform. Registration metadata show that the domain was created through Netlify's automated registration service; the authoritative name server entries are not publicly resolvable, reported as NS_NOT_FOUND.

Two independent phishing blocklists, PhishDestroy and OpenPhish, have already listed the domain, confirming its presence on external threat feeds. VirusTotal scans have returned 14 positive detections out of 91 submitted security vendors, reinforcing the suspicion that the site is being used for malicious credential harvesting. No additional public intelligence such as page title, SSL certificate details, or brand targeting has been disclosed, so the exact phishing lure remains unknown.

The lack of visible DNS delegation and the reliance on Netlify‑shared infrastructure suggest a low‑cost deployment aimed at rapid turnover. Defenders should add the domain and its resolving IP address to outbound and inbound filtering rules, monitor Netlify‑hosted subnets for similar activity, and consider sharing the indicator with internal and external threat‑sharing platforms. Continuous re‑evaluation is advised, as the site remains active and may evolve its payload or targeting vector.