deluxe-tulumba-c77932[.]netlify[.]app

The domain deluxe-tulumba-c77932.netlify.app is presently active and has been identified as a high‑risk credential‑harvesting site. Google Safe Browsing classifies the URL under social engineering, indicating it is likely used to deceive users into submitting sensitive information. VirusTotal analysis records three detections out of ninety‑one scanning engines, confirming that multiple security products have flagged the domain as malicious. Independent blocklist providers PhishDestroy, MetaMask, and SEAL have each listed the address, and the domain appears on three additional security blocklists, reinforcing its reputation as a threat vector.

Infrastructure inspection shows the domain is hosted on Netlify, a popular static‑site and serverless platform, and resolves to the IPv4 address 63.176.8.218. The nameserver information is unavailable (NS_NOT_FOUND), which is typical for Netlify‑hosted sites that rely on the provider’s managed DNS. No SSL certificate details or HTTP response codes have been disclosed, and the page title and content have not been publicly analyzed, leaving the exact phishing lure undefined. Defenders should treat any traffic to this host as malicious.

Immediate actions include adding the domain to DNS blocklists, configuring web proxies to deny HTTP/HTTPS requests, and updating endpoint security signatures to incorporate the three VirusTotal detections. Continuous monitoring of the IP 63.176.8.218 for anomalous connections is advised, as Netlify may host multiple unrelated sites on the same address. Because the site remains active, threat hunters should consider sinkholing the domain where possible and sharing observed indicators of compromise with community blocklists to accelerate broader protection.