gag26[.]netlify[.]app

On 23 July 2026 a new domain, gag26.netlify.app, was observed in threat‑intelligence feeds and classified as a generic phishing site. The domain is hosted on Netlify, as indicated by the registrar information, and resolves to the IPv4 address 63.176.8.218. VirusTotal has recorded 91 vendor scans of the host; none of the scanners have raised a detection at the time of analysis. The domain is currently listed on a single public blocklist and has been added to the PhishDestroy repository, which confirms external confirmation of malicious intent.

No additional infrastructure details such as ASN, geographic location, or SSL certificate metadata are available from the supplied data. The nameserver lookup returned no result, suggesting that the authoritative nameserver information was not disclosed. Because the page content, title, or targeted brand have not been disclosed, the precise lure employed by the site remains undefined.

Analysts should monitor DNS resolution for gag26.netlify.app and block traffic to the associated IP address 63.176.8.218 at network perimeters. Adding the domain to local blocklists and to URL filtering solutions is recommended, as is continued observation of VirusTotal and other reputation services for any future detections. Organizations employing phishing‑prevention tools should ensure that the domain is included in their real‑time protection feeds, and incident‑response teams should treat any credentials submitted to this domain as potentially compromised.