netflixchregion[.]webflow[.]io

The domain netflixchregion.webflow.io was registered on February 21, 2026 through NameCheap, Inc. and is currently reported as offline. Technical analysis shows the hostname resolves to IP address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site served over HTTPS using a certificate issued by Google Trust Services under the WE1 designation, and the underlying infrastructure advertised Cloudflare and HTTP/3 support. An HTTP request returned a 403 status code, indicating that access to the resource is denied.

The page title observed in the scan was "netflixchregion," and the domain is explicitly associated with a brand‑impersonation campaign targeting Netflix. Reputation services reflect a low trust rating, with Gridinsoft assigning a score of 0 out of 100. VirusTotal recorded 15 detections out of 93 scanned security vendors, and the domain appears on a single security blocklist, where it has been flagged by PhishDestroy. These indicators collectively suggest a malicious intent despite the current offline state.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms that may have been hosted before takedown, as no visual or content analysis is available. Defenders should continue to block the IP address 104.18.36.248 at network perimeters, monitor DNS queries for the domain and its parent webflow.io namespace, and ensure that endpoint protection solutions incorporate the observed VirusTotal detections. Ongoing vigilance is recommended, particularly for users accessing Netflix services, to prevent potential credential theft or account compromise linked to this impersonation attempt.