netflix-clone[.]vly[.]site

The domain netflix-clone.vly.site was created on April 25, 2025 and is registered through NameCheap, Inc. It is delegated to the authoritative name servers dns1.registrar-servers.com and dns2.registrar-servers.com. DNS resolution points to the IP address 35.235.84.134, which is assigned to AS396982 (Google LLC) and geolocated to the United States. The site presented a TLS certificate issued by ZeroSSL under the ZeroSSL ECC Domain Secure Site CA, indicating the presence of encryption but offering no assurance of legitimacy. The HTTP response, now taken offline, returned a page title of "Netflix Clone" and the underlying web server stack was identified as Nginx with OpenResty, a common configuration for content delivery networks.

VirusTotal analysis recorded 13 detections out of 95 scanned security vendors, reflecting a moderate level of consensus among automated scanners that the domain is malicious. The site was flagged and blocked by PhishDestroy and is currently listed on one public security blocklist. The primary threat indicator is brand impersonation of Netflix, as explicitly noted in the intelligence brief.

While the technical infrastructure—hosting on a Google Cloud IP, use of a publicly‑available SSL certificate, and standard web server components—does not itself confirm malicious intent, the combination of brand‑targeted page title, detection signatures, and blocklist entries supports a high confidence assessment of a phishing or credential‑harvesting operation. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated name servers for any re‑activation, and consider adding the IP address to reputation filters. Given the domain’s current offline status, future re‑use is plausible; thus, continuous threat‑intel feeds should be consulted for re‑appearance indicators.