frabjous-panda-f9e5d0[.]netlify[.]app

Analysis as of July 27 2026 indicates that the Netlify‑hosted site frabjous-panda-f9e5d0.netlify.app remains active and is being used for credential‑harvesting operations. The domain resolves to the Amazon Web Services address 35.157.26.135 and is served from Netlify’s infrastructure, a common choice for short‑lived phishing deployments because of rapid provisioning and flexible DNS. Google Safe Browsing has classified the URL as a social‑engineering threat, and seven of ninety‑one VirusTotal scanners have returned a malicious verdict, confirming that at least a subset of security products recognize the site as malicious. The domain is currently listed on one public blocklist and has been added to the PhishDestroy blacklist, indicating that network‑level defenses that subscribe to those feeds will already be dropping traffic.

No authoritative nameserver records were returned for the domain, which may be the result of Netlify’s internal DNS handling or an intentional obfuscation technique. The registration record shows the domain was created through Netlify, but no further WHOIS details such as registrar contact or creation date are available in the supplied data. Publicly available evidence does not include a page title, SSL certificate details, HTTP response codes, or any observed branding, so the exact look‑and‑feel of the landing page cannot be confirmed.

Consequently, the specific brand or service being spoofed remains unknown, and analysis of the page content is required to determine the exact credential‑capture vector. Defenders should continue to block the domain at DNS and proxy layers, add the associated IP address to deny lists, and monitor for any new subdomains that resolve to the same hosting IP. Organizations should also educate users about unsolicited login prompts and encourage verification of URLs before entering credentials, especially for services that could be impersonated by a generic phishing site hosted on Netlify.