nithishjadhav-jn[.]github[.]io

This domain, nithishjadhav-jn.github.io, is actively impersonating Netflix through a cloned login interface designed to harvest user credentials. Analysis indicates the site replicates the visual design and authentication flow of the legitimate streaming platform, targeting unsuspecting users who may enter their account details under the false pretense of accessing content. The threat extends beyond credential theft, as compromised accounts could be used for unauthorized subscriptions, payment fraud, or further phishing campaigns targeting the victim’s contacts. The domain’s infrastructure and hosting pattern align with known phishing tactics, particularly those leveraging free hosting services to evade detection and reduce operational costs. Technical evidence confirms the domain’s malicious nature with multiple high-confidence indicators. VirusTotal reports 11 out of 95 security vendors flagging the domain as malicious, a detection rate that significantly exceeds typical false-positive thresholds. The domain is registered through GitHub, Inc., and resolves to the IP address 185.199.109.153, which is associated with Fastly, Inc. (AS54113) in the United States. It appears on one security blocklist, and its SSL certificate is issued by Let’s Encrypt (R12), a common choice among threat actors due to its free and automated issuance process. The page title, 'Netflix Clone,' further corroborates the intent to deceive users by mimicking the legitimate service. Users who have visited nithishjadhav-jn.github.io or entered credentials on the site should take immediate remedial action. First, reset the password for the affected Netflix account and any other platforms where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all accounts to mitigate the risk of unauthorized access. Monitor the account for suspicious activity, such as unrecognized logins or changes to payment methods. If financial information was entered, contact the relevant financial institution to report potential fraud and request a review of recent transactions. Additionally, scan the device used to access the site for malware, as phishing pages may deploy malicious scripts or redirect to secondary payloads. Report the domain to the hosting provider, GitHub, to facilitate takedown efforts and prevent further victimization.