subtle-gumdrop-0c8344[.]netlify[.]app

This domain, subtle-gumdrop-0c8344.netlify.app, is identified as a high-risk brand impersonation threat targeting Netflix. The domain is currently offline, but prior activity involved presenting a fraudulent login page under the title "Netflix," designed to harvest user credentials or payment details by mimicking the legitimate streaming service. Analysis of the domain reveals it was registered on February 22, 2026, through Name.com, Inc., operating under the Netlify platform. The domain resolves to the IP address 35.157.26.135, hosted in Germany (AS16509, Amazon.com, Inc.). Security vendors on VirusTotal flagged this domain as malicious, with 24 out of 95 engines detecting it as a phishing threat. Google Safe Browsing also classified it as phishing, and it appears on one security blocklist. The SSL certificate is issued by DigiCert Inc, specifically under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, which does not mitigate the malicious intent of the domain. The domain has been taken offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant for similar threats. Network administrators are advised to block the domain and its associated IP (35.157.26.135) at the firewall or DNS level. End users should verify the legitimacy of any Netflix-related communications by accessing the service directly through official channels, avoiding links from unsolicited emails or messages. Monitoring for further activity under the same registrar or hosting provider may also be warranted.