netflix-clone-d9498[.]web[.]app

Analysis of the domain netflix-clone-d9498.web.app, observed on July 23, 2026, indicates that it was used for brand impersonation of Netflix. The site presented the page title “Netflix Clone”, directly referencing the target brand. The domain is hosted on Firebase infrastructure, confirmed by the presence of a Google‑issued TLS certificate (Google Trust Services / WR4) and the use of HTTP/3 with HSTS enabled. DNS resolution points to IP address 199.36.158.100, which belongs to AS54113 Fastly, Inc., a content‑delivery network commonly leveraged by Firebase‑based deployments. The registrar record shows the domain was registered through Google LLC, consistent with the Firebase hosting environment.

VirusTotal scans have recorded 15 detections out of 95 security vendors, indicating that multiple anti‑malware engines flag the domain as malicious. The domain appears on one public blocklist and is specifically listed by PhishDestroy, confirming that at least one dedicated anti‑phishing service has taken it down. Current HTTP response is 404, and the domain status is marked offline, suggesting the malicious content has been removed or the site is no longer serving pages. Nameserver information is unavailable (NS_NOT_FOUND), limiting further DNS‑level attribution. No additional threat intelligence sources such as OTX or Safe Browsing entries were provided.

Consequently, while the available evidence strongly supports a brand‑impersonation campaign targeting Netflix users, the exact content and tactics employed on the site cannot be verified because the site is offline. Defenders should continue to block the domain at perimeter and endpoint controls, monitor for any re‑registration attempts, and add the IP address 199.36.158.100 to watchlists, bearing in mind that the address is part of a shared CDN and may host legitimate services.