atgamipost[.]web[.]app

The domain atgamipost.web.app is currently flagged as a high-risk phishing site, specifically for fake login threats. The domain appears to be impersonating the streaming service Netflix, as evidenced by the page title 'Monty python series netflix', which is likely used to lure unsuspecting users into surrendering their credentials. No specific drainer kit has been identified, but the nature of the fake login threat suggests that the infrastructure is designed to collect and exfiltrate user data.

Infrastructure analysis reveals that atgamipost.web.app resolves to the IP address 199.36.158.100, which is located in the United States and is associated with Google LLC. The domain was created on May 20, 2026, and is currently still active. The SSL certificate for the domain is issued by Google Trust Services / WR4, which may lend a false sense of security to visitors. According to VirusTotal, 15 out of 95 security vendors flag this domain as malicious. The domain also appears on one security blocklist and is blocked by the PhishDestroy service. Google Safe Browsing (GSB) has not yet marked this domain as unsafe, which could indicate a relatively new or less widespread threat.

As of the latest assessment, atgamipost.web.app remains active and poses a significant risk to users who may be tricked into providing their Netflix login credentials. Recommended response actions include adding the domain to local blocklists, educating users about the importance of verifying URLs and SSL certificates, and reporting the domain to the relevant authorities and the streaming service being impersonated. Despite the current blocklist and detection rates, the domain's remaining risk is high, and vigilance is advised to prevent potential data breaches and credential theft.