disneyplus-help[.]ddnsking[.]com

This domain, disneyplus-help.ddnsking.com, is confirmed as a brand impersonation threat specifically targeting Disney+. Analysis indicates the site was designed to mimic official Disney+ authentication portals, likely for credential theft purposes. The domain is currently offline, though prior activity suggests malicious intent to harvest user login credentials under false pretenses. Infrastructure analysis reveals the domain was registered through Vitalwerks Internet Solutions, LLC DBA No-IP, and resolved to the IP address 4.220.34.86, geolocated in Norway under AS8075 (Microsoft Corporation). The page title, 'Connexion | Disney +,' aligns with typical phishing patterns, using localized language to increase legitimacy. Security vendors flagged this domain as malicious, with 19 of 95 VirusTotal engines detecting it as phishing. The domain appears on one security blocklist, and Google Safe Browsing previously classified it as a phishing threat. The SSL certificate was issued by an entity associated with automated phishing detection tools, further indicating its fraudulent nature. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to monitor for unauthorized access to Disney+ accounts, particularly those with credentials matching the timeframe of this domain's activity. Network administrators should block the domain and its associated IP (4.220.34.86) at the perimeter. Users who entered credentials on this site should immediately reset passwords and enable multi-factor authentication on their Disney+ accounts. Security teams should review logs for connections to the domain or IP to identify potential compromise.