kemitraanbersama[.]com

The domain kemitraanbersama.com is currently active as a brand impersonation threat specifically targeting Netflix users. Analysis indicates this infrastructure is designed to deceive victims into believing they are interacting with legitimate Netflix services, likely for credential theft or fraudulent payment redirection. The domain remains operational and unmitigated at the time of this report, posing an elevated risk to unsuspecting users. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on November 13, 2025, through Gname.com Pte. Ltd., and resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. Security vendors have flagged this domain, with 17 out of 95 VirusTotal engines detecting it as malicious. Additionally, it appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), and the page title displays "Shopee," which is inconsistent with the impersonated Netflix brand, suggesting either misconfiguration or deliberate obfuscation. The current status of kemitraanbersama.com is active and unremediated, with no evidence of takedown or suspension. Users are strongly advised to avoid interacting with this domain or any associated links. Organizations should update their security controls to block the domain and its resolving IP address (188.114.97.3) at the network level. Individuals who may have engaged with this domain should immediately reset their Netflix credentials, enable multi-factor authentication, and monitor their accounts for unauthorized activity. Security teams are recommended to correlate this domain with other Netflix-themed impersonation campaigns and investigate potential connections to broader credential harvesting or fraud operations.