netflixpage[.]webflow[.]io

This domain, netflixpage.webflow.io, is flagged as a generic phishing site targeting user credentials under the guise of a Netflix-related service. Analysis of the page title, 'BEING's Wondrous Site,' and the domain structure indicates an attempt to deceive users into believing they are interacting with legitimate Netflix content. No specific drainer kit signatures were identified, but the domain’s infrastructure aligns with common phishing tactics, including the use of Webflow for rapid deployment and Cloudflare for obfuscation. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.64.151.8, registered through Webflow, and is currently associated with an SSL certificate issued by Google Trust Services. VirusTotal detection shows 15 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and OISD. Technologies detected include Webflow, Google Hosted Libraries, Google Font API, Cloudflare, and HTTP/3, which are often leveraged to enhance legitimacy and evade basic security checks. As of the latest verification, netflixpage.webflow.io has been taken offline, reducing immediate risk to end users. However, the domain’s infrastructure remains a potential vector for future malicious activity. Organizations are advised to block the domain and its resolving IP at the network level, monitor for related domains registered through Webflow, and educate users on recognizing phishing attempts targeting streaming services. The elevated risk level warrants continued vigilance, particularly for indicators of credential harvesting or secondary payload delivery.