{"success":true,"data":{"id":"netflix-billing-cross-domain","label":"Fake Netflix payment-failed, account-on-hold, or membership-suspended notice sent from a non-Netflix domain demanding billing-update via the embedded link — credential-harvest and card-skim cross-domain phish. Real Netflix mail originates from netflix.com / mailer.netflix.com only.","description":"Fake Netflix payment-failed, account-on-hold, membership-suspended, or update-billing-information notice sent from a non-Netflix sending domain (From / Reply-To / link domains do not align with netflix.com / mailer.netflix.com) demanding the recipient click a link to update payment details or restore streaming access — credential-harvest and card-skim cross-domain phish. Real Netflix billing communications originate exclusively from netflix.com / mailer.netflix.com / info.netflix.com with DMARC-aligned signing and always direct users back to netflix.com — never to third-party domains. Netflix is one of the top-3 most-impersonated consumer brands because its enormous subscriber base and predictable monthly billing cycle make \"your card on file failed\" a high-conversion lure. Distinct from generic billing-update-phish — this targets the Netflix brand / membership-suspended / cross-domain From-link mismatch pretext. Detection: Netflix brand vocabulary (membership on hold, payment declined, update billing) + sender or link domain ≠ netflix.com / mailer.netflix.com + no DMARC alignment. Trash score: +4. Source: GC1-R31; APWG Netflix phishing tracker 2025; Netflix anti-phishing reporting guidance; FTC streaming-service impostor advisory.","tier":"warning","category":"other","isThin":false}}