Phishing detection: netflix-billing-update.com
Netflix Screenshot
Investigate
Domain
netflix-billing-update.com0 CT hosts on apex
urlscan
VirusTotal
Whois
IP
180.178.180.53
ipinfo
Greynoise
URL
https://netflix-billing-update.com
Phishunt analysis Beta
36
medium suspicion suspiciousheuristic risk score · not a probability
Why?
- +6.1 Google Safe Browsing
- +5.3 Keyword match
- +4.5 Brand in title
- +4.0 Young domain
- +3.7 Brand in domain label
- +2.2 Country mismatch
- +1.1 ASN reputation
- +1.1 No CSP header
- +1.0 Site cluster
- +0.9 Young certificate
- +0.9 No registrar lock
- +0.8 Brand + login token
- +0.7 Brand in cert SAN
- +0.7 Unrecognised DNS provider
- +0.6 Final host mismatch
- +0.6 Login text in screenshot
- +0.6 Registrar reputation
- +0.5 Long domain
- +0.3 Free CA
- +0.2 Hyphens
- +0.2 Suspicious TLD
- +0.1 External scripts
26 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
Netflix billing-themed lookalike domain registered two days ago, with Netflix in the page title but no legitimate links to the brand. Flagged by Google Safe Browsing and hosted in Germany. Likely harvests Netflix login and payment card details.
Google Safe BrowsingBrand + login tokenYoung domain
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-02 · confidence 88%
Domain & Network
Whois
Registrar
Hosting Concepts B.V. d/b/a Registrar.eu
Network
Country
Germany
Germany
Hosting
SLAYER GROUP LIMITED
ASN
AS213441
TLS Cert
YR1
GSB category: SOCIAL_ENGINEERING
SANS score: 7 · High entropy: 3.66 (+0.82)|Contains suspicious keyword: update (+20)|Contains suspicious keyword: billing (+20)
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Requests
Resources
Observables
Related websites
Report this phishing
Brand owner
Netflix
Submit to blocklists