69b87a36a3cfa57c2311062f--marvelous-sorbet-904c8f[.]netlify[.]app

The domain 69b87a36a3cfa57c2311062f--marvelous-sorbet-904c8f.netlify.app was created on March 17, 2026 and is hosted on Netlify infrastructure. DNS resolution points to IP address 63.176.8.218, which belongs to ASN16509 owned by Amazon.com, Inc. and is geolocated in Germany. The HTTPS endpoint presents a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate issued by DigiCert Inc. An HTTP request returns a 404 status code, and the page title returned by the server is “네이버 : 로그인”. No nameserver records are available.

Threat classification from the intelligence set identifies the site as a social media phishing campaign that impersonates Facebook. The risk level is marked as elevated and the current status is offline, indicating the site has been taken down. Detection metrics show that 19 of 94 security vendors on VirusTotal flagged the domain, and it appears on a single security blocklist. The domain is also listed as blocked by PhishDestroy.

A Gridinsoft trust score of 0/100 further reinforces the malicious nature of the host. Defenders should add the resolved IP 63.176.8.218 to network blocklists, monitor Netlify‑hosted subdomains for similar patterns, and ingest the domain into phishing‑specific threat feeds. Continuous observation of Amazon‑owned hosting ranges for new domains created after March 2026 may provide early warning of related campaigns. Organizations should reinforce user education around Facebook credential requests and employ safe‑browsing controls that reference the observed blocklist entries.