verify-asset[.]netlify[.]app

Analysis of verify-asset.netlify.app confirms active credential phishing infrastructure targeting cryptocurrency wallet users. The domain, hosted on Netlify's platform, resolves to IP address 35.157.26.135 with no assigned nameservers, a configuration often observed in ephemeral phishing deployments. As of July 30, 2026, the site remains operational despite detection by three security blocklists—PhishDestroy, MetaMask, and SEAL—indicating specialized targeting of crypto-related credentials. Google Safe Browsing classifies this domain under social engineering, corroborating the credential harvesting intent.

VirusTotal reports 15 of 91 security vendors flagging the domain, though the specific detection rules or payloads are not detailed in available intelligence. The absence of nameservers may suggest a short-lived campaign or automated provisioning to evade takedowns. No brand name or phishing kit identifier is currently associated with the domain, leaving the exact impersonation target unclear.

Defenders should treat this domain as high-risk for crypto wallet credential theft and prioritize blocking at DNS, proxy, and endpoint levels. Network security teams are advised to monitor for connections to 35.157.26.135 and inspect any associated TLS certificates for further indicators. Given the domain's persistence despite blocklist presence, expect continued rotation of similar Netlify-hosted subdomains in this campaign.