my-ntflx-th[.]com

Analysis of the domain my-ntflx-th.com indicates it is an active phishing infrastructure targeting users with a Netflix-themed scam. Registered on September 24, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 45.12.1.155. Infrastructure analysis reveals Cloudflare nameservers (dara.ns.cloudflare.com and seamus.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. As of July 29, 2026, the domain appears on one security blocklist and is flagged by PhishDestroy, suggesting prior detection as malicious. VirusTotal reports 11 of 91 security vendors marking the domain as malicious, though the specific detection rules or payloads are not detailed in available intelligence.

The domain name itself contains the substring 'ntflx,' which aligns with common phishing patterns mimicking Netflix branding, though no direct evidence from page content or HTTP responses confirms the exact nature of the scam. No SSL certificate details, HTTP status, or page title data are provided, leaving the precise user interaction flow uncertain. The IP address 45.12.1.155 has not been linked to additional domains in this dataset, but its use in phishing campaigns is consistent with prior observations of bulletproof hosting providers. Defenders should treat this domain as elevated risk.

Blocking resolutions to 45.12.1.155 and adding my-ntflx-th.com to web filtering rules is recommended. Security teams may investigate the IP for additional related domains or shared infrastructure. End users encountering this domain should avoid interaction, as credential harvesting or malware distribution cannot be ruled out. Further analysis of HTTP headers, SSL certificates, or captured payloads could clarify the scam’s mechanics, but current evidence supports classification as a phishing threat.