profound-beijinho-b4df00[.]netlify[.]app

PhishDestroy identifies profound-beijinho-b4df00.netlify.app as an active credential-theft domain currently under investigation for mimicking a legitimate brand’s login workflow.

Profound-beijinho-b4df00.netlify.app exhibits low detection on external scanners, with zero out of ninety-five VirusTotal engines flagging the payload as malicious at the time of analysis. The domain resolves to IPv4 address 63.176.8.218 and is registered through Netlify’s platform, which provides the TLS certificate issued by DigiCert Inc. Persistent analytics show minimal to no presence on public blocklists, and registered trust scores remain in the high-normal range—indicating a recently stood-up host actively avoiding reputation filters. The chosen subdomain pattern suggests an attempt to evade detection via randomized prefixes.

Current status remains ACTIVE, with open-source telemetry confirming live content delivery and active phishing kits. This delivery vector relies on visual similarity to a well-known consumer brand to harvest credentials or session tokens. Organisations should immediately block the domain profound-beijinho-b4df00.netlify.app and its resolving IP 63.176.8.218 at DNS and perimeter layers. Users who may have entered credentials should rotate passwords immediately and enable multi-factor authentication. Monitor authentication logs for anomalous login attempts originating from this infrastructure block.