xn28[.]netlify[.]app

The domain xn28.netlify.app is identified as a high-risk generic phishing domain and is currently active. There is no specific brand impersonation noted, but the domain poses a significant threat to users who may inadvertently access it.

Analysis indicates that xn28.netlify.app has been flagged by 4 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection. The domain is registered through Netlify and resolves to the IP address 35.157.26.135, which is located in Germany (DE) and is part of the AS16509 network operated by Amazon.com, Inc. The SSL certificate is issued by DigiCert Inc, specifically under the DigiCert Global G2 TLS RSA SHA256 2020 CA1. The domain appears on one security blocklist, PhishDestroy, and is currently still active. No specific creation date is provided, but the domain's recent activity and detection suggest it has been operational for a short period.

Given the current status of xn28.netlify.app, it is recommended that users avoid visiting this domain and that network administrators implement blocking rules to prevent access. Security teams should monitor for any additional indicators of compromise (IoCs) and update their threat intelligence databases accordingly. Regularly updating browser and security software can also help mitigate the risk of falling victim to this phishing attempt.