amnraj-amanraj[.]github[.]io

This domain, amnraj-amanraj.github.io, operates as an active phishing site designed to harvest Netflix user credentials through a cloned interface. Analysis of the page title, 'Netflix Clone,' confirms the site mimics legitimate Netflix login pages to deceive users into entering sensitive account information. The threat extends beyond credential theft, as compromised accounts may be exploited for unauthorized subscriptions, payment fraud, or further social engineering attacks targeting contacts associated with the victim's account. Infrastructure analysis reveals multiple indicators of malicious activity. The domain is flagged by 14 out of 95 security vendors on VirusTotal, with one additional security blocklist (PhishDestroy) actively blocking access. The site resolves to IP address 185.199.110.153, hosted on Fastly's infrastructure (AS54113) in the United States, and is registered through GitHub, Inc. Despite its malicious intent, the domain remains operational, leveraging a Let's Encrypt SSL certificate (R12) to create a false sense of legitimacy. The use of GitHub Pages for hosting phishing content is a known tactic to exploit trusted platforms and evade initial detection. Users who have visited amnraj-amanraj.github.io or entered credentials on this site should take immediate action. First, reset Netflix account passwords using a device not previously connected to this domain, and enable multi-factor authentication if available. Review account activity for unauthorized changes, such as new payment methods, profile modifications, or unfamiliar devices. Monitor linked financial accounts for suspicious transactions, as compromised credentials may be used for fraudulent purchases. Clear browser cache and cookies to remove any lingering session data, and consider running a full system scan with updated security tools to detect potential malware. Report the incident to Netflix support and relevant cybersecurity authorities to aid in takedown efforts and prevent further victimization.