netflis-clone[.]netlify[.]app

This domain, netflis-clone.netlify.app, is identified as a high-risk phishing infrastructure impersonating Netflix, a global streaming service provider. The threat type is classified as brand impersonation, designed to deceive users into submitting login credentials or payment details under the pretense of a legitimate service interface. The page title, 'NetFlix clone,' explicitly confirms the intent to mimic the Netflix brand, increasing the likelihood of successful social engineering attacks targeting subscribers.

Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 63.176.8.218, hosted on Amazon.com, Inc. (AS16509) infrastructure in Germany. The domain was registered on February 21, 2026, through Name.com, Inc., with Netlify serving as the hosting provider. Google Safe Browsing has flagged the domain as phishing, while VirusTotal reports 23 out of 95 security vendors detecting malicious activity. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides a false sense of security to potential victims. The domain appears on one security blocklist, specifically PhishDestroy, indicating prior detection and mitigation efforts.

As of the latest verification, netflis-clone.netlify.app has been taken offline, likely due to hosting provider intervention or registrar enforcement. While the immediate threat is neutralized, residual risk remains for users who may have interacted with the domain before its deactivation. Organizations and individuals are advised to monitor for credential reuse, particularly on platforms sharing authentication with Netflix accounts. Network defenders should update blocklists to include this domain and associated IP address, while end-users should be educated on recognizing brand impersonation tactics, such as misspelled domains or unexpected login prompts.