rimzhimsingh8-alt[.]github[.]io

Analysis indicates that the domain rimzhimsingh8-alt.github.io is actively being used for a generic phishing campaign targeting Netflix users in India. The site is designed to closely mimic the legitimate Netflix India portal, aiming to deceive users into providing sensitive information such as login credentials and personal data. This domain poses a high risk to users who may fall victim to such deceptive tactics.

Infrastructure analysis reveals that the domain is hosted on an IP address (185.199.108.153) located in the United States under the AS54113 Fastly, Inc. network. The domain is registered through GitHub, Inc., and is protected by a Let's Encrypt SSL certificate (R12). On VirusTotal, 7 out of 95 security vendors have flagged this domain as malicious, indicating a significant level of suspicion. Additionally, the domain appears on 1 security blocklist and is currently being blocked by PhishDestroy. The current status of the domain is active, suggesting ongoing phishing activities.

Users who have visited this domain are advised to immediately change their Netflix account passwords and enable two-factor authentication (2FA) to enhance account security. They should also monitor their accounts for any unauthorized activity and report any suspicious transactions to their financial institutions. If users suspect they have been compromised, they are encouraged to run a full system scan to detect and remove any potential malware. Further, it is recommended to avoid clicking on links from unsolicited emails or messages and to verify the legitimacy of any website by checking the URL and SSL certificate.