singular-lollipop-73afd5[.]netlify[.]app

This domain, singular-lollipop-73afd5.netlify.app, is flagged as a brand impersonation threat targeting Netflix. Analysis indicates the page title explicitly labels it as a 'Netflix Clone,' suggesting an intent to deceive users into believing they are interacting with legitimate Netflix infrastructure. The domain was hosted on a content delivery platform and did not employ a custom domain, increasing its likelihood of being part of a larger, disposable phishing campaign designed to harvest streaming service credentials or payment information. Infrastructure analysis reveals the following technical indicators: the domain is detected by 17 out of 95 security vendors on a malware analysis platform, indicating moderate consensus on its malicious nature. It was registered through a platform-as-a-service provider and resolved to the IP address 98.84.224.111, geolocated within the United States under autonomous system AS14618. The SSL certificate, issued by a widely trusted certificate authority, was valid and did not exhibit anomalies, though this is common in phishing domains to avoid immediate browser warnings. The domain appeared on two security blocklists, including community-driven repositories tracking active phishing threats. As of the latest verification, singular-lollipop-73afd5.netlify.app has been taken offline, likely following abuse reports or automated takedown procedures. However, the infrastructure used—particularly the hosting provider and content delivery network—remains operational and may be reused for similar campaigns. Users who accessed the domain prior to its removal should assume credential exposure and initiate password resets on their Netflix accounts, along with reviewing linked payment methods for unauthorized activity. Organizations should monitor for related domains leveraging the same hosting pattern or impersonating other streaming services, as this campaign may represent a broader trend in credential harvesting operations.