soldiersmert[.]netlify[.]app

Analysis indicates that soldiersmert.netlify.app is currently active and resolves to the IP address 63.176.8.218. The domain was registered through Netlify, a platform that provides static site hosting and DNS services, and the DNS query returned no nameserver records, consistent with Netlify’s default configuration where internal nameserver details are not publicly exposed. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, indicating that at least one threat‑intelligence feed has flagged it as malicious. VirusTotal records show that the domain has been scanned by 95 vendors, and none of those scanners raised a detection.

The absence of detections does not constitute proof of safety, but it demonstrates that the current payload or landing page has not yet triggered signatures in those engines. The threat classification is generic phishing, and the risk level is listed as under investigation, reflecting that attribution and impact have not been fully established. No SSL certificate details or HTTP response information are available, so the exact behavior of the web server cannot be confirmed at this time.

Because Netlify hosts many legitimate sites, the shared IP 63.176.8.218 is not sufficient alone to attribute malicious intent, yet the blocklist inclusion and PhishDestroy block provide actionable indicators. Defenders should add the domain to outbound filtering rules, monitor DNS queries for the associated IP, and employ URL‑reputation services that reference the existing blocklist entry. Incident response teams should capture logs or screenshots if users interact with the site, and continuous re‑scanning—particularly through VirusTotal and additional blocklist sources—should be performed to detect any future changes in the domain’s threat profile.