netflix-cloneuatu[.]rollout[.]site

The domain netflix-cloneuatu.rollout.site is identified as a brand impersonation threat, specifically targeting Netflix. The domain is currently offline, indicating potential remediation measures have been taken. This report provides a detailed analysis of the domain's infrastructure and security indicators.

Analysis indicates that the domain netflix-cloneuatu.rollout.site was registered through NameCheap, Inc. and resolves to the IP address 37.72.169.170, which is located in the United States and is part of AS29802 HIVELOCITY, Inc. The domain was created on October 24, 2024. The SSL certificate is issued by SSL2BUY EMEA LLC / SSL2BUY EMEA RSA Domain Validation Secure Server CA. The domain has been flagged by 18 out of 95 security vendors on VirusTotal, and it appears on 2 security blocklists, including PhishDestroy and PhishingDB. The page title found on the domain is 'Netflix Clone - Stream Movies & TV Shows | Watch Anywhere, Anytime', which is a clear attempt to mimic the Netflix brand.

Given the current offline status of the domain, it is recommended that organizations and users continue to monitor for any reactivation. Network administrators should consider adding the domain to their DNS blocklists to prevent any potential access. Additionally, users should be educated to recognize and report such brand impersonation attempts to avoid falling victim to phishing or other malicious activities.