fuzzy-netflix-clone[.]web[.]app

This analysis covers domain fuzzy-netflix-clone.web.app classified as brand impersonation targeting Netflix. The infrastructure is designed to mimic legitimate streaming login flows, leveraging cloned branding elements and a deceptive page title "Netflix" to increase user trust and credential capture likelihood. No evidence of crypto drainer functionality is present; the primary objective is credential theft via impersonation.

Technical indicators show TLS issued via Google Trust Services / WR4, hosted behind Fastly Inc (AS54113) with resolved IP 199.36.158.100 located in the United States. The domain is registered through Google LLC. Security telemetry reports VirusTotal score of 18/95 vendors flagging malicious activity. Additionally, it appears on 2 security blocklists including PhishDestroy and PhishingDB, confirming active detection across multiple threat feeds. Current intelligence does not provide creation date or Google Safe Browsing classification status.

At present the domain remains active and resolving, indicating ongoing exposure risk. The combination of brand impersonation, active hosting infrastructure, and moderate-to-high detection ratio suggests a live phishing campaign. Immediate defensive actions should include network-level blocking of the domain, IP 199.36.158.100, and associated Fastly edge patterns, plus monitoring for credential reuse attacks. Users should be warned not to enter credentials and organizations should deploy domain-based URL filtering and email/web gateway rules. Continued monitoring is required due to potential rapid redeployment under similar naming patterns.