unrivaled-medovik-852fd7[.]netlify[.]app

This domain is flagged as a high-risk phishing site specifically targeting Netflix account credentials. Analysis indicates the threat type is a credential harvesting scheme masquerading as Netflix Pakistan, designed to deceive users into submitting login details, payment information, or personal data to unauthorized third parties. Infrastructure analysis reveals multiple concrete indicators of compromise. The domain, registered through Netlify on March 31, 2026, resolves to IP address 63.176.8.218, hosted on AWS EC2 in the eu-central-1 region. Security vendors on VirusTotal flag the domain at a rate of 21 out of 95, while Google Safe Browsing and one additional security blocklist classify it as phishing. The SSL certificate, issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, remains valid, adding a layer of perceived legitimacy to the fraudulent site. The page title explicitly mimics Netflix Pakistan, a common tactic to enhance social engineering effectiveness. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP at the network perimeter. Security teams should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate fingerprint into endpoint detection and response (EDR) systems and web filtering solutions. User awareness training should emphasize verification of domain authenticity before entering credentials, particularly for streaming services. Organizations are advised to monitor for unauthorized access attempts linked to this campaign and reset credentials if exposure is suspected. Given the domain’s active status and high detection rate, proactive containment measures are recommended to prevent data exfiltration.