netflix[.]nandhu[.]co

This domain, netflix.nandhu.co, is a confirmed brand impersonation phishing site targeting Netflix users. The site presents a fraudulent login interface designed to harvest credentials, payment details, or other sensitive information under the guise of the legitimate streaming service. Victims are likely lured via phishing emails, SMS, or malicious advertisements, with the site exploiting the Netflix brand to appear trustworthy. Analysis indicates the domain was created recently and lacks basic security measures, increasing the risk of data compromise for unsuspecting visitors. Infrastructure analysis reveals the domain was registered on October 21, 2024, through Porkbun LLC, a registrar commonly used for both legitimate and malicious domains. The site resolves to IP address 66.33.60.194, hosted on Amazon.com, Inc. infrastructure (AS16509), and lacks an SSL certificate, a red flag for phishing activity. At the time of assessment, 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on two security blocklists: PhishDestroy and PhishingDB. The page title explicitly mimics Netflix, further confirming its intent to deceive users. Users who visited netflix.nandhu.co should take immediate action to mitigate potential risks. First, reset any credentials entered on the site, particularly Netflix login details, and enable multi-factor authentication if available. Monitor financial accounts for unauthorized transactions, as harvested payment data may be used for fraud. Clear browser cache and cookies to remove any residual tracking elements. If personal or financial information was submitted, consider reporting the incident to relevant authorities or identity protection services. Organizations should update security filters to block the domain and its associated IP address (66.33.60.194) to prevent further exposure.