netflix-clone-nine-sand[.]vercel[.]app

PhishDestroy identifies netflix-clone-nine-sand.vercel.app as a high-risk credential-harvesting domain masquerading as a Netflix clone. This site employs social engineering tactics to trick users into surrendering credentials under the guise of account verification or payment processing. No evidence suggests the use of a drainer kit, but the domain’s rapid deployment and obfuscated path (nine-sand) indicate an opportunistic campaign targeting streaming service users. The threat actor leverages Vercel’s hosting infrastructure to lend superficial legitimacy to the phishing page, exploiting free-tier deployments to evade traditional takedown mechanisms.

Technical indicators confirm the domain’s malicious intent: VirusTotal flags this domain with a score of 21/95 security vendors, while Google Safe Browsing classifies it under SOCIAL_ENGINEERING. Registered through Vercel Inc., the domain resolves to IP 64.29.17.3 and has been observed on a single security blocklist. Notably, OpenPhish has already blacklisted this domain, underscoring its active threat status. The SSL certificate, issued by Google Trust Services, may further deceive users into trusting the fraudulent site.

This domain remains active as of the latest assessment, with immediate takedown efforts complicated by Vercel’s hosting policies and the domain’s rapid evasion tactics. Users are strongly advised to avoid interacting with this site and report it through their browser’s built-in safety tools. While current blocklists mitigate exposure, the risk persists due to the threat actor’s potential to re-deploy under new subdomains or variations. Organizations should update firewall rules to block IP 64.29.17.3 and propagate the IOCs to threat intelligence platforms to prevent downstream compromise.