balbhadra-singh43[.]github[.]io

This domain hosts a fraudulent website designed to steal Netflix account credentials through brand impersonation. Visitors are presented with a replica of the Netflix login interface, where entered usernames and passwords are captured by the attackers. The site may also attempt to harvest payment details if users proceed to a fake subscription renewal page. Credential theft of this nature enables account takeovers, unauthorized content access, and potential financial fraud through stored payment methods. Analysis indicates this is a high-confidence phishing operation. The domain is flagged by 11 of 95 security vendors on VirusTotal, including detection as a phishing threat. Infrastructure analysis reveals the site is hosted on GitHub Pages infrastructure, resolving to IPv6 address 2606:50c0:8001::153 under Fastly's network (AS54113). The SSL certificate is issued by Let's Encrypt (YR2), a common choice for both legitimate and malicious sites. The page title explicitly identifies itself as a 'netflix-clone,' and Google Safe Browsing has classified it as phishing. The domain appears on one security blocklist and remains active despite multiple detections. If you visited balbhadra-singh43.github.io and entered login credentials, immediate action is required. First, change your Netflix password using a different device and enable multi-factor authentication if available. Review your account for unauthorized activity, including new profiles, viewing history, or payment methods. Check linked email accounts for password reset attempts or suspicious login notifications. Monitor financial statements for unexpected charges if payment details were entered. Consider revoking and re-adding payment methods associated with the account. Report the incident to Netflix security and your local cybercrime authority. Avoid clicking any links in emails or messages claiming to be from Netflix—access the service directly through official channels.