netflix-clone-gray-three[.]vercel[.]app

This domain, netflix-clone-gray-three.vercel.app, is flagged as an active high-risk brand impersonation phishing site targeting Apple users. Analysis indicates the threat actor has cloned the Netflix India interface, a tactic commonly used to deceive victims into entering credentials or payment details under false pretenses. The domain does not appear to deploy a known drainer kit but relies on visual deception and urgency-driven prompts to harvest sensitive information. The impersonation of a trusted streaming service, combined with the Apple branding misdirection, increases the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to IP address 64.29.17.195, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. Registered through Vercel Inc. on March 02, 2026, the domain uses an SSL certificate issued by Google Trust Services (WR1), providing a false sense of security. VirusTotal detection rates show 19 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The page title, "Netflix India – Watch TV Shows Online, Watch Movies Online," further confirms the attempt to mimic legitimate streaming services. As of the latest assessment, the domain remains active and poses a significant risk to users. While the domain is blocked by some security feeds, its continued operation indicates ongoing malicious activity. Users are advised to avoid interacting with the domain, and organizations should update their web filtering rules to block access. The combination of Apple brand impersonation, high detection rates, and active hosting infrastructure underscores the need for immediate mitigation. Monitoring for similar domains registered through Vercel or resolving to the same IP range is recommended to prevent further exploitation.