eloquent-churros-1fce9e[.]netlify[.]app

Analysis of the domain eloquent-churros-1fce9e.netlify.app, observed on July 23, 2026, indicates a high‑risk brand‑impersonation campaign targeting Netflix users. The site resolves to the IP address 18.208.88.157, which belongs to Amazon.com, Inc. (AS14618) and is located in the United States. The domain is hosted on Netlify, as evidenced by the registration information and the presence of Netlify‑specific technology signatures and HTTP Strict Transport Security (HSTS) headers. The TLS certificate presented is issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 and is valid for the Netlify subdomain, confirming the hosting provider’s involvement. The page title returned by the server is “Netflix India – Watch TV Shows Online, Watch Movies Online,” directly referencing the Netflix brand.

However, the HTTP response code is 404, indicating that the content is no longer accessible. VirusTotal records show that 16 of 95 scanned security vendors flag the domain, and Google Safe Browsing classifies it as a social‑engineering threat. The domain appears on a single security blocklist and has been added to the PhishDestroy blocklist. Nameserver queries resolve to dns1.p04.nsone.net and dns2.p04.nsone.net, consistent with Netlify’s DNS configuration. Reputation services assign a trust score of 1 out of 100 on Scamadviser, reflecting extreme malicious intent.

The limited detection count and single blocklist entry suggest that the campaign may have been short‑lived or rapidly taken down, as the current status is reported offline. No additional evidence such as screenshot captures or malware samples has been released, leaving the exact phishing payload unknown. Defenders should block the domain at network perimeter and update proxy and DNS filtering policies to include both the fully qualified domain name and its resolved IP address. Continuous monitoring of Netlify‑hosted subdomains for similar brand‑themed titles is advised, as the infrastructure can be rapidly provisioned.