site-flixquarvex[.]click

This domain, site-flixquarvex.click, is currently flagged as an active phishing infrastructure specifically designed to harvest Netflix account credentials. Analysis indicates the site employs generic phishing tactics, likely impersonating Netflix login portals to deceive users into submitting sensitive authentication details. The domain remains operational and has not yet been widely detected by automated security systems. Infrastructure analysis reveals the domain was registered on April 30, 2026, through NAMECHEAP INC, a registrar frequently associated with newly deployed phishing campaigns. It resolves to the IP address 188.114.96.3, hosted under AS13335 (Cloudflare, Inc.), which provides anonymization and SSL encryption via a Let's Encrypt certificate (serial number prefix E8). Despite its recent creation, the domain appears on exactly 1 security blocklist, while VirusTotal reports 0 detections out of 95 vendors, suggesting limited visibility in threat intelligence feeds. The use of Cloudflare infrastructure and a valid SSL certificate increases the perceived legitimacy of the site, potentially delaying user suspicion. Current risk assessment categorizes this domain as under active investigation due to its low detection rate and operational status. Organizations and individuals are advised to block traffic to 188.114.96.3 and the domain site-flixquarvex.click at the network perimeter. End users should be educated to verify domain authenticity before entering credentials, particularly for streaming services. Security teams are recommended to monitor for connections to this IP and domain, as the lack of VirusTotal detections may indicate a targeted or emerging campaign. Additional scrutiny of domains registered through NAMECHEAP INC with similar naming patterns (e.g., incorporating 'flix' or streaming-related terms) is warranted.