storied-gecko-a22dbb[.]netlify[.]app

The domain storied-gecko-a22dbb.netlify.app was registered on April 15 2026 through Netlify’s automated registration service. DNS resolution points to the IPv4 address 35.157.26.135, which belongs to an Amazon Web Services EC2 instance in the eu-central-1 region (Germany). The server presents a DigiCert Global G2 TLS RSA SHA-256 2020 CA1 certificate, indicating a valid SSL chain despite the malicious intent. An HTTP request returns a 404 status code, and the page title returned by the server reads "Netflix - Watch TV Shows Online, Watch Movies Online", confirming that the site is intended to impersonate the Netflix brand. The site leverages Netlify’s hosting platform and enforces HTTP Strict Transport Security, which may aid in bypassing some client-side checks.

Security telemetry shows the domain appears on a single blocklist, specifically PhishDestroy, and Google Safe Browsing has classified it as a social-engineering threat. The Gridinsoft trust score is 0 out of 100, reflecting a highly suspicious rating. VirusTotal analysis reports that 22 of 94 scanning engines flagged the domain, reinforcing the malicious assessment. No authoritative nameserver records were returned, and the domain is currently offline, limiting immediate interaction but leaving the infrastructure in place for potential re-use.

Defenders should add the IP address 35.157.26.135 to network-level deny lists and monitor for any Netlify-related subdomains that resolve to the same address range. Email and web filtering solutions should block URLs containing "storied-gecko-a22dbb.netlify.app" and flag any references to Netflix login pages that originate from this host. Continuous monitoring of Netlify’s registration endpoints for similarly patterned domains is advised, as the rapid creation date suggests an automated campaign.