glowing-alfajores-31590d[.]netlify[.]app

Analysis of the domain glowing-alfajores-31590d.netlify.app indicates that it remains active as of the report date, July 27, 2026. The site is hosted on Netlify and resolves to the IPv4 address 63.176.8.218. A review of public reputation services shows that Google Safe Browsing has classified the domain as a social‑engineering threat, and the anti‑phishing service PhishDestroy has listed it as blocked. Additionally, the domain appears on one external security blocklist. VirusTotal data reveal that seven of ninety‑one scanning engines have raised detections against the host, confirming that multiple security products consider it malicious.

The registrar information confirms registration through Netlify, and the authoritative name server query failed, returning NS_NOT_FOUND, which limits further DNS‑level attribution. No SSL certificate details, HTTP response codes, page title, or brand targeting information are presently available, leaving the exact content and lure technique undocumented. The lack of publicly observable SSL/TLS metadata prevents verification of certificate legitimacy, and the absent HTTP status prevents assessment of server behavior such as redirects or content delivery. The domain’s construction, using a random‑looking sub‑domain under the Netlify domain, aligns with patterns observed in other opportunistic phishing infrastructure that leverages free hosting platforms to reduce operational costs.

Although the specific phishing lure has not been captured, the existing indicators are sufficient for a precautionary block. Defenders should immediately block traffic to the domain at perimeter and endpoint layers, add the IP address 63.176.8.218 to deny lists, and monitor for related Netlify sub‑domains that may be leveraged in future campaigns. Continuous re‑scanning through VirusTotal and periodic checks of Google Safe Browsing are advised to capture any changes in the threat posture.