bxxn[.]netlify[.]app

bxxn.netlify.app was observed in multiple security feeds as a phishing infrastructure. The domain is registered through Netlify, which also provides the hosting environment; DNS resolution points to the IPv4 address 35.157.26.135, a Netlify‑owned node. VirusTotal has recorded detections from 7 out of 91 scanned security vendors, indicating that at least a minority of scanners have identified malicious behavior. The domain is listed on a single public blocklist and is actively blocked by the PhishDestroy service, confirming that defensive communities consider it hostile.

Nameserver information could not be retrieved, which may reflect the use of Netlify's default DNS configuration that does not expose conventional NS records. The current operational status is reported as active, meaning the site is still reachable. No public page title, SSL certificate details, or HTTP response codes have been disclosed in the available intelligence, leaving the exact content and delivery mechanisms of the phishing page unknown. Consequently, analysts cannot verify which brand or credential collection page is being impersonated, nor can they assess the presence of obfuscated payloads or additional command‑and‑control infrastructure.

Defenders should prioritize immediate containment of the address 35.157.26.135 and the host name bxxn.netlify.app in network perimeter controls, DNS filtering solutions, and endpoint security policies. Adding the domain to internal blocklists and sharing the indicator with threat‑intel platforms will reduce the chance of accidental exposure. Continuous monitoring of the domain's DNS records is advised, as changes to the underlying IP or NS configuration could indicate a shift in hosting or a takedown attempt. Correlating any future alerts that reference the same IP or Netlify infrastructure with this indicator will help to surface related campaigns.