secure-netflix[.]com

This domain, secure-netflix.com, is identified as a credential harvesting site specifically targeting Netflix users. Analysis confirms the domain is currently offline, though it previously operated as an active brand impersonation platform designed to collect sensitive account credentials from unsuspecting victims. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusually future-dated creation that may indicate domain generation algorithm abuse or registry manipulation. The domain resolved to IP address 158.94.209.87, hosted in the Netherlands under autonomous system AS202412 (Omegatech LTD). Security telemetry shows 17 of 95 vendors on VirusTotal flagged this domain as malicious, while it appeared on one security blocklist. The absence of an SSL certificate further indicates a lack of basic security measures, increasing the likelihood of interception during credential transmission. The observed page title, MezoPlesk, suggests the use of compromised or misconfigured hosting infrastructure commonly exploited for phishing operations. Current status indicates the domain has been taken offline, though residual risk remains due to the future-dated registration and potential for reactivation. Organizations and users are advised to implement proactive measures including DNS-based blocking of the domain and associated IP address, deployment of indicators of compromise in endpoint detection systems, and monitoring for credential reuse attempts. Security teams should review logs for connections to 158.94.209.87 and investigate any authentication attempts originating from this infrastructure. User education should emphasize verification of domain authenticity before entering credentials, particularly for streaming services targeted by credential harvesting campaigns.