public company · US
Netflix
NETFLIX INC
Streaming media.
- Primary official domain
- netflix.com
- Reviewed official domains
- 1 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
32
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
1
domains first source-reported within 30 days
First observed, 30 days
45
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF Could not fully evaluate (sender-specific macros) · Mail: Receives mail (5 MX hosts) · checked 2026-10-19 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- netflix
- Label aliases
- Netflix
- Official domains
- netflix.com (all)
- Generated spellings
- 102 tracked · 77 observed somewhere · 25 not observed (all)
- Can receive mail
- 22 spellings and 9 reported domains publish MX records · mail at Above.com parking (parking placeholder) 7 · hostedmxserver.com 5 · h-email.net (parking placeholder) 3 · 14 more (77 spellings and 32 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
| Uncommon brand names and source labels | ||||||
netflix-za[.]comMail: No mail records · checked 2026-10-19 | Reported by PhishTankPresent in latest snapshot | Strong matchBrand in hostname | 2026-10-13Source reported | Alive45.74.61.10 · Confirmed phishing host address (DomainSpoof, 48 hours), Emerging Threats open block list, Spamhaus DROP (credit: The Spamhaus Project)AS-69HOST (AS205397) · USchecked 2026-10-20 05:00 UTC | 1 source · 2 records | Details |
| Very common brand names | ||||||
secure-netflix[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive45.141.119.29 · Confirmed phishing host address (DomainSpoof, 48 hours)LAIN we love lain, cats and the world wide web (AS211507) · DEchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
update-billing-netflix[.]shekinahglory[.]co[.]zwMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-20 04:55 UTC | 1 source · 1 record | Details |
netflix[.]com[.]sitescorechecker[.]comMail: MXSPF · checked 2026-10-19mail at Zoho (consumer mailbox) · sends via mxsspf.sendpulse.com, Mailjet, Zoho | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive167.172.128.223 · Confirmed phishing host address (DomainSpoof, 48 hours)DigitalOceanDigitalOcean (AS14061) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
netflix[.]sourceaudio[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Google (consumer mailbox) · DMARC policy quarantine · sends via Google, Braintree, SendGrid, 241986812.spf08.hubspotemail.net | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive34.202.193.77Amazon Web ServicesAmazon Web Services (AS14618) · USec2-34-202-193-77.compute-1.amazonaws.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
update-netflix[.]comMail: MXSPFDMARC · checked 2026-10-19mail at GoDaddy (web / mail hosting) · DMARC policy none (monitor only) · sends via GoDaddy | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive216.198.79.1Amazon Web ServicesAmazon Web Services (AS16509) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
netflix-ch-regions-gn6vu[.]wstd[.]ioMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.26.8.229CloudflareCloudflare (AS13335) · US104.26.9.229CloudflareCloudflare (AS13335) · US172.67.68.74CloudflareCloudflare (AS13335) · US2606:4700:20::681a:8e5CloudflareCloudflare (AS13335) · US2606:4700:20::681a:9e5CloudflareCloudflare (AS13335) · US2606:4700:20::ac43:444aCloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
32 registrable domains · 37 hostnames · page 2 of 2← Previous
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.