neflixclone[.]netlify[.]app

This domain, neflixclone.netlify.app, is flagged as a generic phishing site targeting users of a major streaming platform. Analysis indicates the domain was crafted to replicate the login interface of Netflix, likely to capture credentials and payment details through a credential-harvesting kit. No specific drainer kit signatures were identified in available telemetry, but the domain structure and naming convention strongly suggest intent to deceive users into entering sensitive information. Infrastructure analysis reveals the domain was registered through Netlify on February 26, 2026, an unusual future date that may indicate an attempt to evade detection or manipulate registration records. The domain resolves to IP address 35.157.26.135, hosted on infrastructure belonging to AS16509 (Amazon.com, Inc.) in Germany. At the time of detection, VirusTotal reported 23 out of 95 security vendors flagged the domain as malicious. The domain appeared on one security blocklist and was actively blocked by at least one threat intelligence feed. The SSL certificate, issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, does not mitigate the phishing risk, as certificates are routinely issued to malicious domains. The domain has since been taken offline, as indicated by the 'Site not found' page title and confirmed by active probing. Response actions included reporting the domain to the hosting provider and relevant threat intelligence platforms, resulting in its removal from public access. Despite its current offline status, residual risk remains for users who may have interacted with the domain prior to takedown. Organizations are advised to block the domain and IP at perimeter defenses, monitor for credential reuse, and alert affected users to reset passwords. Future monitoring of Netlify-hosted subdomains with similar naming patterns is recommended to detect potential re-emergence or copycat threats.