netflix-cloness[.]surge[.]sh

PhishDestroy identifies netflix-cloness.surge.sh as a live phishing domain impersonating Netflix to harvest login credentials via a fake streaming platform clone. The site employs a credential drainer kit designed to capture user inputs and transmit stolen data to attacker-controlled infrastructure. This campaign targets users seeking free or unauthorized access to Netflix content, leveraging social engineering through the domain's misleading branding.

This domain was flagged by 15 out of 95 security vendors on VirusTotal, indicating elevated risk and widespread detection. It is registered through Surge.sh, a platform often abused by threat actors due to its ease of deployment and lack of stringent monitoring. The domain resolves to IP address 159.203.159.100, which is associated with malicious hosting activity. The site is blocked by OpenPhish, a leading phishing intelligence feed, and carries an SSL certificate issued by Sectigo Limited, enhancing its deceptive legitimacy. It appears on one active security blocklist, further validating its malicious nature.

As of the latest assessment, netflix-cloness.surge.sh remains active and poses an elevated risk to end users. Immediate defensive actions include network-level blocking of the domain and IP address, user awareness campaigns highlighting the specific lure (fake Netflix clone), and integration of the domain into organization-wide threat intelligence platforms. While current defenses such as OpenPhish and VirusTotal detections provide partial coverage, this campaign demonstrates adaptability and may shift infrastructure to evade detection. Users are strongly advised to refrain from engaging with this domain and report any encounters to their security teams. The residual risk remains high due to the active status of the campaign and its use of legitimate hosting services to bypass traditional filters.