newtoki0[.]com

On 23 July 2026, threat‑intel analysts examined the newly registered domain newtoki0.com. The WHOIS record shows the domain was created on 24 February 2026 and registered through NameSilo, LLC. DNS resolution points to the IPv4 address 103.153.182.81, which belongs to AS140947 SnTHostings located in the United States. The authoritative nameservers are ns6.wixdns.net and ns7.wixdns.net, indicating the site was hosted on the Wix platform. No TLS certificate was observed, meaning the site was reachable only via HTTP. An HTTP request returned the page title “Account Suspended”, which is the only visible content captured during the investigation.

The infrastructure is linked to a Netflix brand‑impersonation campaign, as noted in the intelligence feed. A VirusTotal scan recorded 11 of 93 security‑vendor engines flagging the domain as malicious, suggesting the presence of known phishing or malware indicators. The domain appears on a single security blocklist and was actively blocked by the PhishDestroy service before being taken offline, confirming that the site is no longer reachable. While the available data confirm the domain’s association with a Netflix impersonation effort, the exact payload, credential‑capture mechanisms, or phishing kit used remain unknown because the site content has not been archived. Likewise, no Safe Browsing, Open Threat Exchange, or additional reputation scores are available for this host.

Defenders should treat newtoki0.com as a confirmed malicious indicator. Recommended actions include adding the domain and its resolving IP address to DNS‑ and proxy‑level block lists, monitoring for other Wix‑hosted domains registered through NameSilo that reference Netflix, and reviewing outbound traffic for connections to 103.153.182.81. Continuous re‑scanning of the IP range owned by SnTHostings is advised, as the provider may be used for further brand‑impersonation campaigns.