wwmilntu-tw[.]netlify[.]app

Analysis of wwmilntu-tw.netlify.app indicates that the domain is actively used for a generic phishing campaign and is classified as high risk. The domain is hosted on Netlify infrastructure and resolves to the IPv4 address 35.157.26.135. Registration details show the domain was provisioned through Netlify, and the authoritative nameserver information is not available (NS_NOT_FOUND).

Threat intelligence sources have placed the domain on two security blocklists, specifically PhishDestroy and OpenPhish, confirming that multiple reputable anti‑phishing services have identified malicious activity associated with this host. VirusTotal scans report that 15 of 91 security vendors flag the domain, providing additional corroboration of its malicious nature. The current operational status is listed as active, meaning the phishing infrastructure remains reachable.

Defenders should prioritize immediate blocking of the domain at perimeter and endpoint layers, incorporate the associated IP address into threat‑intel feeds, and monitor for any related Netlify‑hosted assets that may share the same IP range. Ongoing vigilance is advised, as the lack of visible nameserver data and the reliance on a cloud hosting provider can facilitate rapid redeployment or domain‑fronting techniques. Continuous re‑evaluation of blocklist entries and periodic VirusTotal rescans are recommended to capture any changes in detection coverage.