trustlayersfix[.]netlify[.]app

Analysis of trustlayersfix.netlify.app indicates that the site was hosted on Amazon’s infrastructure (AS14618) and resolved to the IP 98.84.224.111 located in the United States. The domain, created on 9 May 2018 and registered through Netlify, was serving a page titled “Password Protection” before being taken offline, as evidenced by an HTTP 404 response at the time of scanning. The TLS certificate presented was issued by DigiCert Inc., specifically a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, and the site employed HSTS, confirming the use of standard security headers despite its malicious purpose.

Five of ninety‑three VirusTotal scanners flagged the domain, and it appears on four independent blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The authoritative name servers are dns1.p01.nsone.net through dns4.p01.nsone.net, consistent with Netlify‑hosted deployments. The combination of a password‑related page title, the presence on multiple phishing‑focused blocklists, and the modest detection rate on VirusTotal strongly suggest that the site was being used for credential‑harvesting activities, likely targeting users who were directed to a “Password Protection” prompt.

While the site is currently offline, the infrastructure footprint remains observable. Defenders should continue to block the domain and its associated IP address at network perimeter devices, update URL filtering feeds with the listed blocklist identifiers, and monitor for any re‑registration of the same domain or similar Netlify‑hosted subdomains that reuse the “Password Protection” title. Further analysis of any residual DNS queries or TLS handshake logs could reveal additional campaign infrastructure or victim interaction attempts.