glowing-muffin-5d5c39[.]netlify[.]app

On 23 July 2026 analysis of the domain glowing-muffin-5d5c39.netlify.app confirms that it was actively used for a banking‑phishing campaign before being taken offline. The site resolves to the IPv4 address 18.208.88.157, which belongs to AS14618 operated by Amazon.com, Inc., and is hosted in the United States. Registration information shows the domain is allocated through Netlify, a cloud‑based hosting provider that also supplies the underlying web platform. The TLS certificate presented is issued by DigiCert Inc., specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 root, indicating a valid HTTPS endpoint. DNS resolution uses the nsone.net name servers dns1.p04.nsone.net and dns2.p04.nsone.net.

An HTTP request to the domain returns a 404 status with the page title “Site not found”, confirming that the content has been removed. VirusTotal scans recorded 13 detections out of 95 security engines, reflecting consensus among multiple vendors that the domain is malicious. The domain is listed on at least one public blocklist and has been actively blocked by the PhishDestroy service. Technology fingerprints identify Netlify hosting, HTTP Strict Transport Security (HSTS), and the DigiCert certificate chain. The available intelligence does not disclose the exact phishing landing page or the credential‑harvesting mechanisms that were previously hosted, limiting insight into the specific banking targets or credential fields used.

No additional threat‑intel sources such as OTX or Google Safe Browsing entries are referenced, and the lack of current content prevents a full behavioral analysis. Defenders should continue to block the domain at network perimeter devices, update DNS sinkhole lists with the observed IP address 18.208.88.157 and the associated name servers, and monitor for any re‑registration attempts that reuse the same Netlify account or similar sub‑domain patterns.