ntflx-reabonnieren[.]com

Security analysts at PhishDestroy have identified ntflx-reabonnieren.com as an active phishing domain impersonating Netflix’s re-subscription portal. The domain leverages a visually convincing replica of the legitimate Netflix interface to trick users into entering their payment and login credentials. Unsuspecting visitors are presented with a fraudulent “re-subscribe” page, prompting them for sensitive financial and account details under the guise of preventing service interruption. This tactic is a classic example of credential harvesting and financial fraud, targeting users who may panic when faced with a sudden subscription expiry notice. The domain’s rapid deployment—registered just days ago—suggests opportunistic timing, likely aligned with billing cycles when users are more likely to re-subscribe. The threat posed by ntflx-reabonnieren.com is confirmed through multiple technical indicators. According to VirusTotal scans conducted on seed a217ec, the domain currently shows zero detections out of 95 antivirus engines, indicating a low initial detection rate that may rise as threat intelligence disseminates. The domain resolves to IP address 172.67.164.160, a Cloudflare endpoint commonly abused for phishing due to its legitimate traffic-handling capabilities masking malicious activity. Registration details reveal the domain was created on April 03, 2026, through OwnRegistrar, Inc., a registrar known to host both legitimate and fraudulent domains with minimal oversight. Additionally, analysis of related IOCs (indicators of compromise) shows this domain has not yet been added to major public blocklists, further increasing its potential reach and effectiveness. Users who have visited ntflx-reabonnieren.com should immediately check their accounts for unauthorized access or unauthorized transactions. If any credentials were entered on the site, change the password immediately and enable multi-factor authentication (MFA) on the real Netflix account. Monitor bank statements for suspicious charges, as the threat actors may use harvested payment data for fraud. Report the domain to Netflix’s official phishing reporting channel and consider using a password manager to help detect similar fraudulent sites in the future. Organizations should block this domain at the network level using DNS filtering or firewall rules to prevent further exposure. Proactive user education remains critical in mitigating the impact of such credential-harvesting campaigns.