resilient-bublanina-c4ca5b[.]netlify[.]app

The domain resilient-bublanina-c4ca5b.netlify.app was registered on March 01, 2026 and remains active as of the report date, July 12, 2026. It is classified as a high‑risk brand‑impersonation campaign targeting the "Airdrop Scam" brand, with the page title observed as "$Peace - Airdrop Live". The site is delivered via Netlify infrastructure and the HTTP response returns a 200 status code, indicating a fully operational front‑end. The phishing kit identified matches the known "Airdrop Scam" kit, and the site is currently blocked by multiple security services including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, underscoring the malicious nature of the content.

Infrastructure analysis shows the domain resolves to IP address 63.176.8.218, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. The domain uses Netlify’s default nameserver set: dns1.p01.nsone.net, dns2.p01.nsone.net, dns3.p01.nsone.net, and dns4.p01.nsone.net. TLS termination is provided by a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, confirming the presence of HTTPS with a valid chain. Detected technologies include Unpkg, Netlify, and HTTP Strict Transport Security (HSTS), consistent with typical Netlify‑hosted sites.

Threat intelligence indicates the domain appears on three security blocklists and has been flagged by one out of ninety‑five VirusTotal scanners. The combination of a zero‑score trust rating, active blocklist entries, and a confirmed phishing kit justifies the high risk rating. Defenders should immediately add the domain and its resolved IP address to deny‑list rules, update URL filtering policies to include the observed Netlify sub‑domain pattern, and monitor for any related activity leveraging the same nameserver set or IP range. Continuous re‑evaluation is recommended, as the short registration window suggests a rapidly deployed campaign that may spawn additional variants.