gutscheinnetflx[.]com

gutscheinnetflx.com is a newly registered domain (created 12 July 2025) that has been identified as a social media phishing candidate. The domain resolves to the IP address 34.149.87.45, which is owned by Google LLC (AS396982) and is located in the United States. DNS resolution is provided by Wix’s authoritative name servers ns12.wixdns.net and ns13.wixdns.net, confirming that the site was provisioned through the Wix.com Ltd. registrar. The site presents a TLS certificate issued by Let’s Encrypt (R12), indicating that HTTPS is available, but an HTTP request returns a 404 status code, suggesting that the malicious landing page has been removed or is temporarily unavailable. The page title retrieved during analysis was “Registrierung”, a generic German term for registration, and the underlying web stack includes Wix, React, AngularJS, and jQuery, which are common components of quickly assembled phishing kits.

Threat intelligence signals reinforce the malicious classification. The domain appears on one public security blocklist and is listed in 18 AlienVault OTX pulses, indicating repeated observations across multiple threat‑sharing feeds. VirusTotal analysis recorded detections from 15 of 95 scanning engines, and PhishDestroy has also taken the domain offline. The combination of a recent creation date, use of a reputable hosting provider, and the presence of a valid TLS certificate is a typical pattern for short‑lived phishing infrastructure designed to evade static reputation systems.

Uncertainty remains regarding the exact social‑media platform or account being spoofed, as the page content has not been captured and the only visible artifact is the generic “Registrierung” title. Analysts should therefore treat the domain as high‑confidence phishing and enforce blocking at network perimeter and DNS layers. Continuous monitoring of the associated IP address and Wix‑hosted domains is advised, as the infrastructure could be repurposed for new campaigns.