netflixfw54[.]rollout[.]site

Analysis of netflixfw54.rollout.site shows a recent brand‑impersonation campaign targeting Netflix. The domain was registered through NameCheap, Inc. on 24 October 2024 and resolves to the IPv4 address 37.72.169.170, which is allocated to AS29802 HIVELOCITY, Inc. in the United States. The hosting provider’s nameservers, coco.bunny.net and kiki.bunny.net, are typical of BunnyCDN infrastructure, suggesting the attacker leveraged a content‑delivery service to serve malicious content. The TLS certificate presented is issued by SSL2BUY EMEA LLC under the SSL2BUY EMEA RSA Domain Validation Secure Server CA, a commercial certificate authority frequently used by malicious operators to obtain rapid, domain‑validated certificates. VirusTotal scans have recorded 20 detections out of 95 security vendors, indicating a moderate level of consensus among scanners that the site is malicious.

The domain appears on a single public blocklist, PhishDestroy, confirming that at least one external threat‑intelligence feed has already flagged it. The page title returned by HTTP requests is “Netflix - Watch TV Shows Online, Watch Movies Online,” which aligns with the declared brand target of Netflix and reinforces the impersonation intent. The site’s current status is offline, which limits direct observation of its landing page or any credential‑capture mechanisms. Consequently, the exact visual layout, form fields, or malicious payloads cannot be confirmed at this time. Nevertheless, the combination of a brand‑specific page title, a commercial SSL certificate, and multiple vendor detections provides sufficient evidence to classify the domain as a confirmed brand‑impersonation phishing site.

Defenders should add 37.72.169.170 to network‑level blocklists and enforce DNS filtering for the domain netflixfw54.rollout.site. Continuous monitoring of the associated nameservers (coco.bunny.net, kiki.bunny.net) is recommended, as abuse of the BunnyCDN platform may recur with different subdomains.