aryansingh-200621[.]github[.]io

This domain, aryansingh-200621.github.io, is identified as a high-risk phishing infrastructure targeting users of a major streaming service. Analysis of the page title, 'Netflix Clone,' indicates an attempt to impersonate the Netflix login interface, likely designed to harvest user credentials. The domain does not appear to be associated with a known drainer kit based on current intelligence, but the presence of a cloned login page suggests a credential theft operation. No direct financial transaction components are observed at this stage, though credential compromise could lead to secondary fraud. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.199.109.153, hosted on AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common tactic to create a false sense of security. Google Safe Browsing has flagged the domain as phishing, and it appears on at least one security blocklist. VirusTotal reports 5 out of 95 security vendors detecting malicious activity associated with this domain. The domain is registered through GitHub, Inc., leveraging a GitHub Pages subdomain for hosting, which is frequently abused due to its low barrier to entry and perceived legitimacy. As of the latest verification, the domain remains active and continues to serve the phishing content. No takedown actions have been observed, and the SSL certificate remains valid. Users are advised to avoid interacting with this domain and to report any credentials entered on this site as compromised. Organizations should update blocklists to include this domain and its resolving IP address. The remaining risk is assessed as high due to the domain's active status, the use of a trusted hosting provider, and the potential for credential theft leading to account takeovers or further phishing campaigns.