nightsforest[.]netlify[.]app

Analysis as of July 29, 2026 indicates that nightsforest.netlify.app is an active malicious infrastructure element associated with generic phishing. The domain was first registered on May 08, 2018 through Netlify, a popular static‑site hosting provider that also functions as the registrar. DNS resolution points exclusively to the IP address 35.157.26.135, an address owned by Netlify’s cloud‑hosting network, confirming that the site is hosted on the same platform used by many legitimate sites, which can aid evasion of simple IP‑based blocklists. Reputation services have flagged the domain.

VirusTotal reports that 13 of 91 scanned security vendors label the domain as malicious, providing a modest but non‑trivial detection rate. The domain appears on one public security blocklist and is explicitly listed by the PhishDestroy blocklist, indicating that at least one dedicated anti‑phishing feed has identified it as a phishing vector. No additional public intelligence such as OTX tags, Safe Browsing entries, or SSL certificate details are currently available. Because the site is hosted on a shared Netlify infrastructure, traditional host‑based reputation checks may produce false positives for unrelated sites on the same provider.

Defenders should therefore rely on domain‑level indicators rather than IP alone. Recommended mitigation steps include adding nightsforest.netlify.app to DNS‑based deny lists, configuring web proxy or gateway filters to block HTTP requests to the domain, and monitoring outbound traffic for connections to 35.157.26.135. Continuous re‑evaluation is advised, as further analysis of the site’s HTTP response, page title, and certificate could reveal additional indicators of compromise.