netflixgpt-66e93[.]firebaseapp[.]com

Analysis of netflixgpt-66e93.firebaseapp.com indicates that the host is provisioned through Google Firebase and serves a default “React App” page that returns HTTP 404. The site presents a valid SSL certificate issued by Google Trust Services under the WR4 intermediate, confirming that TLS termination is performed by Google’s infrastructure. DNS resolution points to IP 199.36.158.100, an address owned by Fastly (AS54113) located in the United States. The presence of HSTS and HTTP/3 suggests a modern web stack, but no application‑level content beyond the generic title has been observed.

The domain is explicitly listed as impersonating the Netflix brand, and it appears on a single external blocklist. VirusTotal scans show that 16 of 95 security vendors have flagged the domain, and PhishDestroy has already taken the site offline. Registration details reveal that the domain was created via Google Firebase, a common platform for malicious actors due to its rapid deployment capabilities. No further intelligence such as phishing page screenshots, credential‑harvesting forms, or malicious payloads is available, leaving the exact scam mechanics uncertain.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor the associated IP address for any future reuse, and update brand‑specific threat feeds to include this indicator. Because the TLS certificate is trusted, users may be misled by the padlock icon, so awareness messaging that emphasizes verification of URL spelling is recommended. Ongoing observation of the Fastly edge node is advised in case the infrastructure is repurposed for new malicious campaigns.