gleaming-froyo-440fc8[.]netlify[.]app

gleaming-froyo-440fc8.netlify.app is currently active and returns HTTP 200. The site is hosted on Netlify and resolves to 35.157.26.135, an Amazon.com, Inc. address located in Germany (AS16509). The TLS certificate is issued by DigiCert Global G2, confirming a valid HTTPS endpoint. Security feeds ScamSniffer and PhishDestroy have already listed the domain, and it appears on two additional blocklists. VirusTotal scans show six of ninety‑five AV engines flag the host as malicious. The page title advertises “$GOAT | DEGEN GOAT COIN – MOON OR BROKE 🐐🚀”, and the domain is classified as a brand‑impersonation campaign targeting the foundation brand. The site was registered on 8 September 2025 and has a Gridinsoft trust score of 0/100, indicating a high likelihood of abuse. No further analysis of the page content or payload has been published, so the exact malicious behavior (credential capture, malware delivery, etc.) remains unknown. Defenders should immediately block the domain and its resolved IP at network perimeter devices, add the host to URL filtering and DNS sink‑hole lists, and monitor for additional Netlify subdomains that resolve to the same ASN. Continuous threat‑intel monitoring is advised to detect any evolution of the campaign, and any observed traffic should be logged for forensic correlation.