netfilx-account[.]dynv6[.]net

This domain, netfilx-account.dynv6.net, is identified as a credential phishing site specifically impersonating Netflix to harvest user login credentials. Analysis confirms its current status as offline, though prior activity poses residual risk to users who may have interacted with it during its operational window.

Technical indicators reveal the domain was flagged by 18 of 95 security vendors on VirusTotal, indicating broad detection of malicious intent. It resolves to the IP address 150.136.252.61, hosted on Oracle Cloud Infrastructure in the us-ashburn-1 region. The domain was registered through Hetzner Online GmbH and appears on at least one security blocklist. The SSL certificate is issued by Let's Encrypt (R12), a common tactic to lend superficial legitimacy to phishing infrastructure. The page title explicitly mimics Netflix, reinforcing its deceptive purpose.

While the domain is currently offline, organizations and users should remain vigilant. Network administrators are advised to block the domain and its associated IP (150.136.252.61) at the perimeter. End-users who may have visited the site should reset Netflix credentials immediately and enable multi-factor authentication. Security teams should monitor for related domains leveraging similar naming conventions or infrastructure patterns, particularly those using dynamic DNS services like dynv6.net.