tfjg-rjgu-edri-zcgw-osrg-rfgj[.]netlify[.]app

Analysis of tfjg-rjgu-edri-zcgw-osrg-rfgj.netlify.app, observed on July 24, 2026, indicates the domain was provisioned on Netlify and is currently offline, returning HTTP 404 with page title “Site not found”. The site employed Netlify hosting and advertised HSTS, and the TLS certificate presented is DigiCert Global G2 TLS RSA SHA256 2020 CA1, issued by DigiCert Inc. DNS resolution points to IP 98.84.224.111, which belongs to AS14618 Amazon.com, Inc., located in the United States. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy.

VirusTotal scans show nine of ninety‑five AV engines flagged the domain, reinforcing the suspicion of malicious use. No further content was retrieved, and nameserver information is unavailable. The limited visible evidence suggests the domain was created for a generic phishing campaign, but the exact target, payload, or phishing kit cannot be confirmed from the current data set.

Defenders should continue to monitor network traffic for connections to 98.84.224.111 and enforce blocking of the fully qualified domain name at perimeter and DNS filtering layers. Adding the domain to internal blocklists and sharing the indicator with threat‑intelligence feeds will reduce exposure. Because the site is offline, active exploitation is unlikely, yet the infrastructure—particularly the Netlify‑hosted front end and Amazon‑owned IP—may be reused for future campaigns, so periodic re‑resolution checks are advisable.