tanvi-gupta-cmd[.]github[.]io

The domain tanvi-gupta-cmd.github.io is currently hosting a high-risk phishing page impersonating Netflix, designed to harvest user credentials. Analysis confirms the page title as "Netflix Clone," indicating a targeted brand impersonation scheme. The domain remains operational and has not been taken down despite its malicious intent. Infrastructure analysis reveals the domain is flagged by 12 of 95 security vendors on VirusTotal, a notably elevated detection rate for phishing activity. It is registered through GitHub, Inc., and resolves to the IPv6 address 2606:50c0:8000::153, geolocated to the United States under AS54113 (Fastly, Inc.). The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. The domain appears on one security blocklist, though this underrepresents its confirmed risk level. Current status indicates the phishing page remains active, posing an ongoing threat to users. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include this indicator. Users who may have interacted with the page should reset credentials immediately, enable multi-factor authentication, and monitor accounts for unauthorized activity. Security teams should treat this domain as confirmed malicious and prioritize its inclusion in threat intelligence feeds.