voluble-crostata-bae7d9[.]netlify[.]app

This domain, voluble-crostata-bae7d9.netlify.app, is flagged as a credential theft operation targeting user login credentials. Analysis indicates the domain was designed to harvest sensitive authentication details through deceptive login portals. As of the latest scan, the domain has been taken offline, though prior activity suggests it was actively used in malicious campaigns. Infrastructure analysis reveals the domain was registered through Netlify and resolved to the IP address 63.176.8.218, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in Germany. The domain was created on March 02, 2026, and has been flagged by 20 of 95 security vendors on VirusTotal. It appears on one known security blocklist, with a DigiCert Global G2 TLS RSA SHA256 2020 CA1 SSL certificate issued by DigiCert Inc. The page title, 'Site not found,' suggests either a takedown or an attempt to obscure malicious activity post-exploitation. The domain’s current offline status reduces immediate risk, but its prior use in credential theft operations warrants continued monitoring. Organizations should update blocklists to include this domain and its associated IP address. Users who may have interacted with the domain are advised to reset credentials for any accounts accessed during the period of activity. Security teams should review logs for connections to 63.176.8.218 and monitor for similar domains registered under Netlify or resolving to the same IP range.