earnest-palmier-f63be7[.]netlify[.]app

The domain earnest-palmier-f63be7.netlify.app was observed hosting a credential‑phishing page that presents the page title "Produbanco - Login" and explicitly impersonates the Colombian banking brand Produbanco. Infrastructure analysis shows the domain resolves to IP address 63.176.8.218, which is allocated to Amazon.com, Inc. in Germany (AS16509). The host is served via Netlify, as indicated by the registrar information and the presence of Netlify‑specific technology signatures, including HTTP Strict Transport Security (HSTS). The site employed a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, confirming a valid SSL chain despite the malicious intent.

DNS resolution is handled by nsone.net name servers (dns1.p04.nsone.net, dns2.p04.nsone.net). HTTP probing returned a 404 status, suggesting the content has been removed or is no longer reachable. Google Safe Browsing flagged the domain for social engineering, and the site appears on at least one external blocklist (PhishDestroy). Scamadviser assigned a trust score of 1/100, reinforcing its low reputation.

VirusTotal scans recorded 15 detections out of 95 security vendors, providing independent confirmation of malicious behavior. The domain is currently marked as offline, but the underlying infrastructure—particularly the shared Netlify hosting and the Amazon IP address—could be reused for future impersonation campaigns targeting Produbanco customers or other financial institutions. Defenders should continue to block the domain at perimeter and DNS layers, monitor traffic to the associated IP range for anomalous credential‑harvesting activity, and consider broader detection rules that flag Netlify subdomains presenting brand‑specific page titles. Ongoing brand monitoring for Produbanco should include alerts for new Netlify‑hosted domains that replicate the "Login" page title, and incident response teams should be prepared to investigate similar patterns should they reappear.