Phishing detection: netflix-renovacion-es.com
Netflix Screenshot
Screenshot captured by urlscan.io on 2026-11-03T22:11 UTC: our own render of this page came back blank.
Investigate
Domain
netflix-renovacion-es.com1 CT host on apex
urlscan
VirusTotal
Whois
IP
180.178.191.159
ipinfo
Greynoise
URL
https://netflix-renovacion-es.com
Phishunt analysis Beta
31
medium suspicion suspiciousheuristic risk score · not a probability
Why?
- +6.1 Google Safe Browsing
- +5.3 Keyword match
- +4.0 Young domain
- +3.7 Brand in domain label
- +2.6 ASN reputation
- +2.0 Site cluster
- +1.1 No CSP header
- +1.1 No HSTS header
- +0.9 Young certificate
- +0.9 No registrar lock
- +0.7 Brand in cert SAN
- +0.7 Unrecognised DNS provider
- +0.6 Login text in screenshot
- +0.5 Long domain
- +0.3 Free CA
- +0.2 Hyphens
- +0.2 Suspicious TLD
20 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
Spanish-language Netflix renewal lookalike on a newly registered domain with Netflix in the name and certificate. Likely lures victims to enter account or payment details. Flagged by Google Safe Browsing for social engineering.
Brand in domain labelGoogle Safe BrowsingYoung domain
AI-generated from stored detector signals - the AI never visited the site. · 2026-11-02 · confidence 80%
Domain & Network
Whois
Registrar
Key-Systems GmbH
Network
Country
United States
United States
Hosting
49.3 Networking LLC
ASN
AS399979
TLS Cert
YR1
External detection
Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io · SANS ISC
Requests
Resources
Observables
Related websites
Report this phishing
Brand owner
Netflix
Submit to blocklists