hxxps[://]nxftlex-mailnirop.duckdns[.]org/cpsess92/index.html/87139405/emanage/rontend/aper_lanter/dex.ht/cprap/NETF-en/ contains an active phishing payload against Netflix users.
$ host nxftlex-mailnirop.duckdns.org
nxftlex-mailnirop.duckdns.org has address 143.198.52.218