Phishing detection: zh-netflix.cn

Netflix
https://zh-netflix.cn Access site
Screenshot
Screenshot of zh-netflix.cn
Investigate
Domain zh-netflix.cn0 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 154.19.248.17
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://zh-netflix.cn
urlscan Wayback archive.today
Cert -
crt.sh Censys Google CT
Phishunt analysis Beta
22 low suspicionheuristic risk score · not a probability
Keyword matchOpenPhishNo CSP header
15 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Netflix impersonation site registered under a .cn domain, using a matching favicon kit and Netflix-branded keywords. Shares IP infrastructure at ASN 8796 with other malicious hosts. Likely targets Chinese-speaking users to steal streaming account credentials.

OpenPhishFavicon (kit)Shared IP cluster
AI-generated from stored detector signals - the AI never visited the site. · 2026-08-05 · confidence 72%
Domain & Network
Whois
Network
IP 154.19.248.17
Country United StatesUnited States
Hosting FASTNET DATA INC
ASN AS8796
TLS Cert -
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Related infrastructure Betasuspected links from shared infrastructure, not attribution
Suspected cluster #208 · 3 indicators · confidence High · targets: Netflix
cn-netflix.cn 68 same IP same nameservers similar name same favicon
active 2026-08-05
web-netflix.cn 60 same IP same nameservers same favicon same screenshot
active 2026-08-05
Top 2 of 2 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Brand owner Netflix
phishing@netflix.com
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-08-05 01:01 UTC  ·  Last refreshed 2026-08-05 07:30 UTC