netflix-members[.]site[.]tstsolutions[.]com[.]co

Analysis of the domain netflix-members.site.tstsolutions.com.co indicates active brand impersonation targeting Google, despite displaying a Netflix page title. The subdomain was registered on November 13, 2023, through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to the IP address 162.241.61.244, hosted under AS19871 (Network Solutions, LLC) in the United States. Nameservers are provided by HostGator (ns24.hostgator.co and ns25.hostgator.co). The domain lacks an SSL certificate and returns an HTTP 301 redirect status, which is atypical for legitimate brand services.

Security vendor detections on VirusTotal report 16 of 95 engines flagging the domain as malicious, while PhishDestroy has already blocked it. The domain appears on at least one security blocklist, and Gridinsoft assigns it a trust score of 0/100. The discrepancy between the declared brand target (Google) and the observed page title (Netflix) suggests either misdirection or a multi-brand phishing operation. No evidence confirms the specific phishing kit or payload in use, and the exact content of the site remains unanalyzed.

Defenders should treat this domain as high-risk infrastructure. Network-level blocking of 162.241.61.244 and the parent domain is recommended. Organizations should monitor for credential submission attempts linked to this host, particularly those impersonating Google services. Further investigation into the hosting provider’s abuse response and registrar’s enforcement actions may be warranted given the domain’s persistence since late 2023.