sweet-starship-257991[.]netlify[.]app

This domain, sweet-starship-257991.netlify.app, operates as a Netflix brand impersonation phishing site designed to harvest user credentials. The page title explicitly identifies itself as a "Netflix clone," indicating an intent to deceive victims into entering login details on a fraudulent interface. Such attacks typically redirect users to fabricated login portals that mimic legitimate services, capturing sensitive information for unauthorized account access or financial fraud. The domain’s infrastructure and design suggest a focus on exploiting trust in the targeted brand to facilitate credential theft at scale. Analysis of the domain reveals multiple indicators of malicious activity. The domain was registered on February 21, 2026, through Name.com, Inc., under Netlify’s hosting platform, and resolves to the IP address 35.157.26.135, located in Germany under Amazon.com, Inc.’s AS16509. VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate, issued by DigiCert Inc, does not mitigate the risk, as phishing sites frequently employ valid certificates to appear legitimate. The rapid detection by multiple vendors underscores the domain’s association with known phishing campaigns targeting streaming service users. Users who visited sweet-starship-257991.netlify.app should assume their credentials may have been compromised. Immediate action is required, including changing passwords for the targeted service and any accounts sharing the same credentials. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor financial statements and account activity for signs of misuse, and report the incident to the legitimate service provider for further investigation. If personal or payment information was entered, consider placing a fraud alert on credit files to prevent identity theft. Organizations should update blocklists to include this domain and its associated IP address to prevent further exposure.