netflix-clone-coral-iota[.]vercel[.]app

Domain netflix-clone-coral-iota.vercel.app is assessed as credential theft phishing infrastructure impersonating a Netflix-themed clone environment. The domain is currently active and engineered to capture user authentication credentials via deceptive login flows resembling legitimate streaming access portals.

Telemetry indicates multiple independent detections and infrastructure-level risk signals. It is flagged by 21 of 95 VirusTotal security vendors and appears on 1 security blocklist. The domain resolves to IP 64.29.17.67 hosted in the United States under AS16509 Amazon.com, Inc. SSL inspection shows a certificate issued by Google Trust Services (WR1). Registration and hosting are associated with Vercel Inc. Additionally, Google Safe Browsing categorizes the domain as phishing, reinforcing high-confidence malicious classification.

The domain remains active, indicating ongoing exposure risk for credential harvesting and potential account takeover attempts. Users who accessed or submitted credentials should assume compromise and immediately reset passwords, revoke active sessions, and enable multi-factor authentication where available. Network defenders are advised to block the domain at DNS, proxy, and endpoint layers, monitor for connections to 64.29.17.67, and review authentication logs for suspicious login attempts originating from this infrastructure.