live-app-desk[.]pages[.]dev

PhishDestroy identifies a recently activated phishing domain, live-app-desk.pages.dev, actively impersonating Netflix to harvest user credentials. This domain employs a spoofed login portal designed to mimic the legitimate Netflix interface, tricking victims into entering their account credentials under the guise of a 'payment verification' or 'account suspension' alert. The threat actor leverages Cloudflare's infrastructure to host the fraudulent page, which resolves to IP address 188.114.96.3, further complicating traditional takedown efforts. Security researchers note that this campaign is part of a broader trend of credential-harvesting phishing attacks targeting streaming service users, with threat actors increasingly relying on legitimate cloud services to evade detection. Analysis of this domain reveals concerning technical indicators, including a clean initial scan with zero detections across 95 VirusTotal engines, indicating a low-profile deployment likely designed to avoid early detection. The domain was registered through Cloudflare, Inc., and utilizes a Google Trust Services SSL certificate to enhance its legitimacy. Given the absence of proactive blocking, this domain represents an active and evolving threat. The lack of immediate detection underscores the need for real-time threat intelligence and proactive monitoring to identify such campaigns before widespread compromise occurs. Users who suspect interaction with this phishing domain should immediately change their Netflix password and enable two-factor authentication (2FA) if not already active. Monitor bank and payment card statements for unauthorized transactions, as stolen credentials may be leveraged for financial fraud. Report the incident to Netflix directly through their official support channels and consider running a full antivirus scan on any device used to access the fraudulent link. PhishDestroy advises exercising extreme caution with any unsolicited messages claiming to be from Netflix, particularly those urging immediate action or containing suspicious links.