golden-capybara-730f55[.]netlify[.]app

This domain is flagged for elevated risk due to brand impersonation targeting Netflix. Analysis confirms the infrastructure was designed to mimic legitimate login portals, a tactic commonly employed to harvest credentials or distribute malicious payloads under the guise of trusted services.

Infrastructure analysis reveals the domain golden-capybara-730f55.netlify.app was registered through Netlify on May 09, 2018, and resolves to IP address 35.157.26.135, hosted on Amazon.com, Inc. (AS16509) in Germany. The page title explicitly matches "Netflix," reinforcing the impersonation attempt. Security vendors flagged this domain in 22 out of 95 VirusTotal scans, and it appears on at least one security blocklist. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), does not mitigate the inherent risk of the fraudulent content.

Mitigation requires immediate action from network administrators and end-users. Organizations should block the domain and its resolving IP (35.157.26.135) at the perimeter firewall or DNS level. End-users who may have interacted with the domain should reset credentials for Netflix and any accounts sharing the same password. Security teams should monitor for anomalous authentication attempts or unauthorized access linked to this infrastructure. Given the domain’s current offline status, further investigation into related artifacts—such as associated email addresses, subdomains, or hosting patterns—is recommended to preempt potential resurgence.