vikiflix[.]netlify[.]app

This domain, vikiflix.netlify.app, is identified as a high-risk credential theft phishing site designed to harvest user login credentials through deceptive login portals. Analysis indicates the infrastructure was configured to mimic legitimate streaming or subscription services, likely exploiting brand familiarity to trick victims into entering sensitive account details. No direct association with a specific brand or drainer kit was confirmed, though the operational pattern aligns with credential harvesting campaigns targeting entertainment or media platforms. The domain exhibits no overt cryptocurrency-related functionality, distinguishing it from wallet-drainer schemes. Infrastructure analysis reveals the domain was registered through Netlify on March 04, 2026, an unusually future-dated creation timestamp that may indicate automated or fraudulent registration practices. It resolves to the IP address 63.176.8.218, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in Germany. The domain is flagged by Google Safe Browsing for phishing activity and appears on one security blocklist. VirusTotal reports 22 out of 95 security vendors detecting the domain as malicious, with detections spanning phishing, fraud, and social engineering categories. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides encrypted connections but does not mitigate the underlying fraudulent intent. As of the latest assessment, vikiflix.netlify.app has been taken offline, returning a 502 Bad Gateway error, suggesting either voluntary takedown, hosting provider intervention, or backend infrastructure failure. Despite its current inactive status, the domain remains a residual threat due to cached DNS records, browser history entries, or potential re-activation on alternative hosting. Users who interacted with the site prior to its takedown should immediately reset credentials for any accounts entered, enable multi-factor authentication, and monitor for unauthorized access. Organizations are advised to update web filtering rules to block the domain and its associated IP, while security teams should investigate logs for prior connections to 63.176.8.218 or related Netlify-hosted subdomains.