streaming-ui-demo[.]netlify[.]app

This domain, streaming-ui-demo.netlify.app, is confirmed as an active phishing site specializing in brand impersonation, specifically targeting users of a major streaming platform. The threat type involves a fraudulent login portal designed to harvest credentials, likely for account takeover or unauthorized access to subscription services. Given its high-risk classification, immediate mitigation is recommended for all users who may have interacted with the page. Analysis indicates the domain is hosted on Netlify’s platform and resolves to the IP address 35.157.26.135, located within an AWS EC2 instance in the eu-central-1 region. Security vendor detections on VirusTotal stand at 18 out of 95, with Google Safe Browsing explicitly flagging it as phishing. The domain appears on at least one security blocklist, and its SSL certificate is issued by DigiCert Inc, a legitimate provider, which does not mitigate the underlying threat. The page title, 'Netflix India – Watch TV Shows Online, Watch Movies Online,' directly mimics the official branding to deceive users. To mitigate risks associated with this credential-harvesting phishing campaign, affected users should immediately reset passwords for the impersonated service and any other platforms where identical credentials may have been reused. Network administrators are advised to block the domain and its resolving IP (35.157.26.135) at the perimeter. Security teams should monitor for related indicators of compromise, including anomalous login attempts or unauthorized access to accounts linked to the targeted brand. Users should verify the authenticity of any login portal by cross-referencing the URL with the official domain before entering credentials.