animated-biscochitos-d09876[.]netlify[.]app

animated-biscochitos-d09876.netlify.app is currently flagged by Google Safe Browsing as a social‑engineering site. VirusTotal records show that 13 of 91 scanned security vendors have raised detections against the domain, indicating a moderate to high likelihood of malicious intent. The domain appears on a single public security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one operational anti‑phishing platform has identified it as hostile. Registration information reveals the site was created through Netlify’s automated deployment service, a common hosting choice for short‑lived malicious pages because of its rapid provisioning and free tier.

No additional registrar details, ASN, or geolocation data are provided in the available intelligence. SSL/TLS negotiation succeeds using Netlify‑issued certificates, which does not provide any guarantee of legitimacy because the certificate is automatically issued to the hosting provider’s wildcard domain. HTTP responses return a standard 200 status code, and the page title has not been disclosed in the current feed, so the visual lure and credential‑harvesting mechanics remain unverified. The combination of social‑engineering classification, multi‑vendor detections, and blocklist presence suggests the domain is being used to lure victims into providing personal or login information, consistent with a generic phishing campaign.

Defenders should immediately add the domain to outbound and inbound deny lists, monitor DNS queries for the Netlify‑hosted CNAME, and enrich future investigations with URL‑level screenshots when available. Continuous re‑scanning on VirusTotal and periodic checks against Google Safe Browsing are recommended to capture any changes in detection confidence. Because the site is hosted on a shared infrastructure, blocking the full Netlify netblock may produce collateral impact; therefore, precise rule creation targeting the full FQDN is preferred.