coruscating-tarsier-015048[.]netlify[.]app

Analysis of the domain coruscating-tarsier-015048.netlify.app, first observed on February 21, 2026, indicates an elevated‑risk banking phishing operation that has since been taken offline. The domain was registered through Name.com, Inc. and hosted on Netlify, as reflected in the technology fingerprint that identified Netlify and HSTS support. DNS resolution points to the address 63.176.8.218, an Amazon.com, Inc. (AS16509) host located in Germany. The TLS certificate presented is a DigiCert Global G2 RSA SHA256 2020 CA1 chain, confirming that standard HTTPS was in place at the time of capture.

HTTP probing returned a 404 status with the page title "Site not found," suggesting the malicious landing page was removed or never served legitimate content. VirusTotal scanned the domain with 93 vendors, of which 15 flagged it as malicious, and the domain appears on a single external blocklist. PhishDestroy has also blocked the domain, reinforcing the consensus that it was used for credential harvesting targeting banking customers.

While the exact phishing kit, lure page layout, and victim interaction details remain unknown due to the offline status, the available indicators—registrar, hosting AS, SSL, detection count, and blocklist presence—provide sufficient context for defensive action. Security teams should continue to block the domain at network perimeters, update URL filtering rules, and monitor for any re‑registration attempts or infrastructure reuse. Analysts are advised to correlate any related host activity with the IP 63.176.8.218 and to watch for similar Netlify‑based deployments that exhibit the same threat attributes.