charming-marshmallow-61005d[.]netlify[.]app

Infrastructure analysis reveals that the domain charming-marshmallow-61005d.netlify.app, registered on March 2, 2026, was flagged as a high-risk phishing site impersonating Google Accounts. The page title 'Sign in - Google Accounts' directly indicates an attempt to mimic Google's authentication portal, aligning with the scam type classified as banking phishing. The domain was hosted on Netlify infrastructure and resolved to IP 63.176.8.218, located in Germany under Amazon.com, Inc.'s AS16509. Google Safe Browsing categorized this domain as social engineering, while PhishDestroy and at least one additional security blocklist blocked access to it. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), does not mitigate the risk, as phishing sites frequently use valid certificates.

As of July 24, 2026, the domain returns an HTTP 404 status, suggesting it has been taken offline, though residual DNS or cached records may persist. Nineteen of 93 security vendors on VirusTotal flagged the domain, reinforcing its malicious classification. No evidence of a phishing kit or additional brand impersonation beyond Google was identified in the available data. Defenders should treat this domain as compromised infrastructure.

Historical logs should be reviewed for connections to 63.176.8.218 or the domain itself, particularly during its active period. Netlify's role as the registrar and hosting provider indicates a pattern of abuse leveraging legitimate cloud platforms. While the domain is currently offline, similar infrastructure may re-emerge under different subdomains or aliases. Organizations are advised to block the domain and IP at perimeter controls and monitor for related indicators of compromise.