netlfix-clone-one[.]vercel[.]app

This domain, netlfix-clone-one.vercel.app, presents a confirmed credential harvesting threat targeting streaming service users. Analysis indicates the site mimics the Netflix login interface to deceive victims into submitting account credentials, payment details, and personal information. The fraudulent page employs identical branding elements, including the Netflix logo, color scheme, and layout, to enhance legitimacy and reduce user suspicion during the phishing attempt. Infrastructure analysis reveals multiple high-risk indicators associated with this domain. The site was registered through Vercel on April 17, 2026, and resolves to IP address 64.29.17.67, located in the United States under Vercel, Inc. Detection engines on VirusTotal flagged the domain as malicious in 16 out of 95 scans, while it appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WR1), provides encrypted connections that may further mislead users into trusting the fraudulent site. Despite these warnings, the domain remains operational and accessible. Users who visited netlfix-clone-one.vercel.app should immediately take corrective action to mitigate potential compromise. Those who entered credentials should change their Netflix password and enable multi-factor authentication on all linked accounts. Financial information submitted through the site necessitates contacting banking institutions to monitor for unauthorized transactions. System scans using updated security software are recommended to detect any secondary payloads. Network administrators should block access to 64.29.17.67 and the domain at the perimeter level to prevent further exposure within organizational environments.