99forests[.]netlify[.]app

Analysis of 99forests.netlify.app, observed on July 29, 2026, indicates active phishing infrastructure. The site is hosted on Netlify and was registered on May 08, 2018. DNS resolution points to the Amazon Web Services IP 35.157.26.135, which is allocated to AS16509 in Germany. The domain appears on the PhishDestroy blocklist and is listed in at least one additional security blocklist, confirming that threat‑intelligence feeds have flagged it.

VirusTotal scans have returned 14 positive detections out of 91 antivirus engines, further corroborating malicious reputation. The publicly visible page title reads “[🔦] 99 Nights in the Forest 🔦”, which does not disclose a targeted brand or service, and no additional content has been disclosed in the current data set. The convergence of multiple independent indicators—blocklist inclusion, elevated VirusTotal detection rate, and hosting on a cloud provider commonly abused for phishing—places the domain at an elevated risk level. However, the lack of publicly released payload samples, SSL certificate details, and HTTP response codes limits a full technical characterization of the phishing payload or credential‑harvesting mechanisms.

Defenders should block network traffic to 35.157.26.135 and add 99forests.netlify.app to domain‑allow‑list exclusion policies. Continuous monitoring of the domain’s DNS records and periodic rescans on VirusTotal are recommended to detect any changes in the detection profile. Organizations employing email filters should ensure that links pointing to this domain are quarantined, and incident response teams should be prepared to investigate any credential submissions that reference the “99 Nights in the Forest” title.