aryan-clone[.]netlify[.]app

This domain, aryan-clone.netlify.app, is identified as a brand impersonation threat specifically targeting Netflix. Analysis confirms the site mimics Netflix India’s official interface, presenting a fraudulent login portal designed to harvest user credentials. The domain is currently offline, but prior activity indicates active malicious intent under the guise of legitimate streaming services. Infrastructure analysis reveals the domain was created on February 21, 2026, and resolves to the IP address 63.176.8.218, hosted under AS16509 (Amazon.com, Inc.) in Germany. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides a false sense of security. Security vendors flagged the domain in 20 of 95 VirusTotal scans, and it appears on one security blocklist. The registrar, Name.com, Inc., facilitated the domain’s deployment through Netlify’s platform, a common vector for rapid phishing site deployment. Current status indicates the domain has been taken offline, likely due to detection and reporting. However, the risk remains elevated for users who may have interacted with the site prior to its removal. Organizations and individuals are advised to monitor for unauthorized access attempts linked to this domain, reset credentials if exposure is suspected, and implement multi-factor authentication to mitigate credential theft risks. Network administrators should block the IP address 63.176.8.218 and monitor for related domains using similar naming conventions or infrastructure patterns.