netflix2024[.]com

This domain, netflix2024.com, is actively impersonating the Netflix brand as part of a streaming-related phishing campaign. Registered on September 30, 2025, through a major registrar, the domain resolves to the IP address 104.21.52.180, which is hosted on Cloudflare's infrastructure (AS13335). The site returns an HTTP 200 status, indicating it is operational, though no SSL certificate is present. The page title explicitly displays 'netflix 2024,' reinforcing its attempt to deceive users into believing it is an official Netflix platform. Analysis of threat intelligence sources reveals significant detection activity. Thirteen out of ninety-five security vendors on VirusTotal have flagged this domain as malicious. Additionally, it appears on two security blocklists and has been included in fifteen threat intelligence pulses within AlienVault OTX. The domain's trust score from Gridinsoft is 1 out of 100, further corroborating its high-risk classification. Nameservers associated with the domain are keira.ns.cloudflare.com and paul.ns.cloudflare.com, consistent with Cloudflare's hosting environment. The exact content and functionality of the site remain unconfirmed, as no detailed forensic analysis of the page has been conducted. However, given the domain's registration details, hosting infrastructure, and the presence of a Netflix-branded page title, it is assessed to be part of a phishing operation targeting streaming service users. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for any connections to the associated IP address 104.21.52.180. The domain remains active as of July 12, 2026, and continued vigilance is recommended due to its persistent threat status.