jojo[.]luxe

This domain, jojo.luxe, is identified as a high-risk phishing site specifically designed to impersonate Netflix login pages. Analysis confirms it is actively harvesting user credentials through a fraudulent interface mimicking the official Netflix authentication portal. The threat type is classified as a fake login page under brand impersonation, targeting subscribers of the streaming service with the intent to steal account access and personal data. Infrastructure analysis reveals the domain was registered on August 13, 2025, through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn). It currently resolves to the IP address 43.156.51.36, which has been flagged by 13 of 95 security vendors on VirusTotal. The page title explicitly displays 'Netflix,' reinforcing the deception. No additional blocklist entries or trust scores from other threat intelligence platforms were provided, but the detection ratio and recent registration strongly correlate with malicious intent. The domain remains active as of the latest verification. Organizations and individuals are advised to block access to jojo.luxe at the network level, update endpoint protection rules to include this domain and its associated IP, and alert users to avoid entering credentials on this site. Security teams should monitor for credential reuse attempts stemming from this campaign and consider initiating password reset protocols for potentially compromised accounts. Given the high-risk classification, immediate action is recommended to mitigate exposure.