Phishing detection: update-subscription-netflix.com
Netflix Screenshot
No screenshot available yet
Captured automatically on the next refresh cycle
Investigate
Domain
update-subscription-netflix.com2 CT hosts on apex
urlscan
VirusTotal
Whois
IP
46.8.9.226
ipinfo
Greynoise
URL
https://update-subscription-netflix.com
Phishunt analysis Beta
21
low suspicionheuristic risk score · not a probability
Why?
- +6.1 Google Safe Browsing
- +5.3 Keyword match
- +2.2 Country mismatch
- +1.1 ASN reputation
- +1.1 No CSP header
- +1.1 No HSTS header
- +0.8 Brand + login token
- +0.7 Unrecognised DNS provider
- +0.6 Long domain
- +0.6 Final host mismatch
- +0.6 Registrar reputation
- +0.2 Hyphens
- +0.2 Suspicious TLD
18 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
Site impersonates Netflix using a combosquat domain framed around subscription updates, likely harvesting billing credentials or account access. Flagged as social engineering by Google Safe Browsing and hosted in Czechia, with multiple redirects obscuring the final destination.
Brand + login tokenGoogle Safe BrowsingKeyword match
AI-generated from stored detector signals - the AI never visited the site. · 2026-09-19 · confidence 78%
Domain & Network
Whois
Registrar
Ultahost, Inc.
Network
IP
46.8.9.226
Country
Czechia
Czechia
Hosting
Gransy s.r.o.
ASN
AS60592
TLS Cert
-
External detection
Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Requests
Resources
Observables
Related websites
Report this phishing
Brand owner
Netflix
Submit to blocklists