netflix.surf - phishunt.io

Netflix

https://netflix.surf Access site

Screenshot

Investigate

Domain netflix.surf2 CT hosts on apex

urlscan

page.domain

VirusTotal

Whois

See every phishunt record for this domain

IP 172.67.216.98

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://netflix.surf

urlscan

Wayback

archive.today

Cert Let's Encrypt

crt.sh

Censys

Google CT

Phishunt analysis Beta

31 medium suspicion suspiciousheuristic risk score · not a probability

Why?

+5.3 Keyword match
+5.1 Site cluster
+5.1 urlscan.io
+4.5 Brand in title
+4.1 Brand in screenshot
+1.9 ASN reputation
+1.1 No CSP header
+1.1 No HSTS header
+0.7 Brand in cert SAN
+0.7 Brand typo
+0.6 Suspicious TLD
+0.3 Free CA
+0.2 Long domain
+0.1 External scripts

18 signals fired · detector v3.0.0

AI analysis AIBeta

Credential harvesting

Impersonates Netflix using a .surf TLD domain with the Netflix brand embedded in the TLS certificate. A same-origin credential form is present for login data capture. Flagged as malicious by urlscan. Brand color inconsistencies suggest an imperfect visual clone.

Brand in cert SANSame-origin formKeyword match

AI-generated from stored detector signals - the AI never visited the site. · 2026-07-23 · confidence 65%

Domain & Network

Whois

Registrar Dynadot Inc

Network

IP 172.67.216.98

Country