netlify01[.]netlify[.]app

The domain netlify01.netlify.app is identified as a high-risk brand impersonation threat targeting Netflix. Analysis confirms the domain is currently offline but was actively used for phishing operations impersonating the streaming service, as indicated by the page title labeled "Netflix." Infrastructure analysis reveals the domain was flagged by 22 of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly marking it as phishing. The domain was registered through Name.com, Inc. (Netlify) and resolves to the IP address 35.157.26.135, hosted on Amazon.com, Inc. infrastructure (AS16509) located in Germany. The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1). Created on February 21, 2026, the domain appears on at least one security blocklist and was previously blocked by enterprise phishing detection systems. The domain is currently offline, but residual risk remains due to its recent activity and detection history. Organizations are advised to block the domain and associated IP address (35.157.26.135) at the network perimeter. Security teams should monitor for any re-emergence of the domain or similar subdomains under netlify.app. End-users should be educated on recognizing brand impersonation tactics, particularly those mimicking login portals for streaming services. If credentials were entered on this domain, immediate password resets and multi-factor authentication enforcement are recommended.