Case 007 — Netflix PhaaS
"Made with ❤ By Hands" Kit · 228 Domains · 69HOST AS205397

The domain netf-reintegration-definition.com was registered 2026-08-15T21:55:51Z — less than 24 hours before investigation. The name follows a deliberate obfuscation pattern: "netf" (Netflix abbreviation) combined with a nonsense English phrase ("reintegration-definition") to pass naive keyword filters while remaining meaningless.

The root page delivers an obfuscated JavaScript redirect. The JS is encoded using a string-shuffling array technique (common in phishing kits) to evade static scanners, but decodes trivially to a single instruction:

The /pages/ endpoint runs a three-factor fingerprinting gate before serving phishing content. Requests that fail the check receive a debug response revealing the exact values being checked:

A reverse IP lookup on 45.74.61.10 (69HOST LLC, AS205397) reveals 228 active domains — a full Phishing-as-a-Service platform covering multiple brands and target countries. This is not a single criminal deploying one phishing page; it is a PhaaS operation offering credential harvesting infrastructure across 12+ brand categories targeting 8+ European countries.

69HOST LLC (AS205397) is a Frankfurt-based hosting provider whose infrastructure is almost exclusively hosting phishing and fraud domains in this reverse-IP lookup. Zero legitimate commercial or consumer sites visible among the 228 results — all domain names are brand-impersonation patterns.

The HTML comment <!-- Made with <3 By Hands --> is a persistent signature left by the kit author across all deployments. This is a known marker in French-language phishing kit distribution circles — the author markets their kit, receives payment (often in cryptocurrency), and deploys infrastructure for paying operators, or sells the kit for self-hosting.

Additional kit characteristics consistent with this author's style:

• Random fake historical dates in HTML comments (1907, 1929, 1938...) — anti-crawl noise designed to confuse timeline analysis tools
• Random 10-15 character alphanumeric tokens in HTML comments — possibly session/license markers or just noise
• Obfuscated JS redirect using string-array shuffling with a numeric XOR seed (identical pattern seen in multiple French PhaaS kits)
• Server-side ASN gate (PHP-level, not JS) — protects ALL kit deployments on the server regardless of operator skill
• Assets served from sibling directories (../img/) — consistent kit folder structure across all 228 deployments

The HTML comment <!-- Made with <3 By Hands --> is not just a provenance marker — it is a searchable fingerprint across the open internet. Indexing engines like Shodan, Censys, and FOFA scan HTTP response bodies and can return every server currently serving this string, including deployments on different IPs than the 45.74.61.10 cluster identified through reverse-IP pivot.

This technique converts a single kit signature into a proactive sensor: new deployments registered after this investigation can be found before they register victims, by querying the same string against live internet scan data. Security teams can create persistent saved searches (Shodan Alerts, Censys Watchlists) to receive notifications when new servers serving the signature come online.

Recommended queries (passive, read-only — using publicly indexed data, not active scanning):

This approach scales the single 228-domain pivot into a global coverage map of every server currently running the same kit. The kit author's consistent use of this signature across all deployments — likely a vanity mark or license watermark — inadvertently created a permanent identification mechanism for the entire platform.

Multi-target reporting required: the hosting provider (69HOST), the registrar (Global Domain Group), the impersonated brand (Netflix), French national CERT (ANSSI) for the French citizen targeting scope, and Europol EC3 for the multi-country PhaaS platform.

Phase 1 — DNS + WHOIS: Initial DNS lookup reveals IP 45.74.61.10. WHOIS confirms 1-day-old domain via Global Domain Group LLC, NS records pointing to 69HOST's own nameservers.

Phase 2 — Reverse IP pivot: Single HackerTarget reverse-IP query on 45.74.61.10 returns 228 domains — the full PhaaS platform inventory. Brand analysis of all domain names reveals the complete attack surface: 12+ brand categories, 8+ EU countries.

Phase 3 — JS deobfuscation: Root page JS decoded from ~800-byte shuffled-array obfuscation to a single window.location.href = './pages/' redirect. Kit creator comment Made with <3 By Hands extracted from HTML.

Phase 4 — Evasion infrastructure dissection: Systematic controlled probes with varied User-Agents, Accept-Language, and Referer headers caused the server's gate to self-disclose its three-factor algorithm in its own response body. This is a deliberate OSINT technique — the server's debug output became the intelligence product. The investigation stopped at infrastructure characterisation: no attempt was made to interact with or submit data to phishing forms, consistent with passive OSINT principles.

Operator identity: No registration data visible (WHOIS privacy / redacted by registrar). 69HOST LLC appears to operate permissively — the entire ASN is phishing infrastructure. This is consistent with bulletproof-adjacent hosting that accepts payment without content scrutiny.

The screenshot below captures the deliberate controlled probe that mapped the gate's logic. By systematically varying User-Agent, Accept-Language, and Referer headers, the server's own response disclosed exactly which values it checks and what it outputs for each scenario. The gate's debug output — visible in the server response — reveals the full fingerprinting algorithm in one request.

This is an intentional OSINT technique: rather than attempting to access phishing content (which would cross into unauthorized territory), the investigation focused on fully characterising the anti-detection infrastructure — which is itself a primary threat intelligence finding.