Phishing detection: login.netflix-pay.click

Netflix
https://login.netflix-pay.click Access site
Screenshot
Screenshot of login.netflix-pay.click
Investigate
Domain login.netflix-pay.click103 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 172.236.100.134
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://login.netflix-pay.click
urlscan Wayback archive.today
Cert -
crt.sh Censys Google CT
Phishunt analysis Beta
30 low suspicionheuristic risk score · not a probability
Keyword matchBrand in domain labelBrand + login token
17 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Impersonates a Netflix payment portal using a combosquat domain on an abusable TLD to harvest account credentials or payment details. Hosted on Akamai and flagged by Google Safe Browsing as social engineering.

Google Safe BrowsingBrand + login tokenKeyword match
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-22 · confidence 84%
Domain & Network
Whois
Registrar Dynadot, LLC
Network
IP 172.236.100.134
Country United StatesUnited States
Hosting Akamai Connected Cloud
ASN AS63949
TLS Cert -
External detection Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Report this phishing
Network / ASN Akamai Connected Cloud
abuse@linode.com
Brand owner Netflix
phishing@netflix.com
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-07-12 15:41 UTC  ·  Last refreshed 2026-08-10 13:30 UTC