A new (old) campaign has made its presence known once more, now capable of double-checking visitors IPs. The phishing pages are identical to the campaign that Jrme Segura, one of our senior researchers, found and documented last August. On the other, we have found some new things about the nefixx domain that are equally of note: visitors of the domain are encouraged to sign up for a free trial of Netflix. The domain then uses this data to double-check if the visitor has been to the site before via the following request.”]
Source: https://blog.malwarebytes.com/cybercrime/2015/02/netflix-phish-rehash-polices-its-visitors/