netflix-clone-fff8b[.]web[.]app

PhishDestroy identifies an active Netflix clone phishing campaign hosted at netflix-clone-fff8b.web.app, designed to deceive users into entering their login credentials under the guise of a fake streaming service. This domain mimics Netflix’s branding to harvest sensitive account information, exposing victims to credential theft and potential financial fraud. The threat is elevated due to its use of a Google-owned domain (.web.app) and spoofed SSL certificates, which can easily mislead less cautious users into believing the site is legitimate. This domain was flagged by 21 out of 95 VirusTotal security vendors, placing it under heightened scrutiny. It is registered through Google LLC, leveraging the company’s Firebase hosting service to lend an air of authenticity. The domain appears on 2 major security blocklists, including Phishunt and OpenPhish, and resolves to IP address 199.36.158.100. The SSL certificate, issued by Google Trust Services, further reduces suspicion by ensuring HTTPS encryption, a common tactic used by threat actors to bypass browser security warnings. The combination of these factors creates a sophisticated phishing lure that targets Netflix users specifically. If you have visited netflix-clone-fff8b.web.app, immediately change your Netflix password and enable multi-factor authentication (MFA) to secure your account. Review your account activity for any unauthorized transactions or profile changes. Use a reputable antivirus tool to scan your device for malware, as phishing sites often deploy keyloggers or credential-stealing scripts. Report the domain to Netflix’s phishing reporting system and consider notifying your bank if you entered financial details. Vigilance is critical—legitimate Netflix communications will never direct you to sign in via a third-party domain. Stay alert for similar lures exploiting trusted brands.