sparkly-dragon-5360b6.netlify.app
Category: Phishing
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Description of sparkly-dragon-5360b6.netlify.app
This URL is a subdomain hosted on Netlify rather than a standalone branded domain. Based on the page title and visible content, it appears to present a webmail sign-in page styled as "Aruba Mail," with an email/password form and branding that suggests it is attempting to mimic a mail login experience for Aruba users.
The domain name itself, "sparkly-dragon-5360b6.netlify.app," looks auto-generated and does not appear to match the branding shown on the page. That mismatch is notable because legitimate organizations typically host login portals on their own primary domains or clearly associated subdomains. Based on the available screenshot and metadata, this page appears to function as a credential-entry page rather than a general informational website.
Safety Assessment for sparkly-dragon-5360b6.netlify.app
The scan data shows mixed signals at the time of this scan. On one hand, 0 out of 92 security engines detected malware-related issues, and the malware scan did not identify flagged files, links, or iframes. On the other hand, a major threat database listed the URL for social-engineering activity, which is a stronger content-risk signal than a clean malware scan alone.
The page content also raises concern because it presents itself as an Aruba Mail sign-in page while being hosted on an unrelated Netlify subdomain. In plain terms, the domain closely resembles a temporary hosting address rather than an official Aruba-owned login location, so the page may be a look-alike intended to collect credentials. Login pages on third-party hosting platforms can be legitimate in some cases, but this combination of branding mismatch and social-engineering listing materially increases risk.
Based on these findings, this website may pose potential risks to visitors, particularly anyone asked to enter email credentials. While no malware payloads were detected at the time of this scan, the available evidence is consistent with a possible phishing or credential-harvesting page.
Technical Description
The site uses a valid TLS certificate issued by DigiCert, with expiry shown in 2027, which means the connection appears to be encrypted in transit. It is hosted on Netlify infrastructure backed by AWS EC2 in Frankfurt, Germany, and the domain uses Netlify-associated nameservers. DNSSEC is unsigned.
From a technical standpoint, the main concern is not the certificate itself but the hosting and branding context: a generic Netlify subdomain is presenting a branded webmail login page. That setup can be used for benign testing or temporary deployments, but in this case it may also indicate impersonation or credential collection. No malicious files, external links, or iframe activity were identified in the supplied scan data.
Share your experience with this website. Was it safe? Did you encounter any issues?