netflix-clone-beta-sand[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat targeting Apple users through credential harvesting techniques. Analysis indicates the domain netflix-clone-beta-sand.vercel.app presents itself as a legitimate streaming service while covertly collecting Apple ID login credentials, despite displaying a Netflix-branded interface with the page title 'Netflix India ‐ Watch TV Shows online, Watch Movies Online.' The discrepancy between the claimed service and the actual targeted brand represents a sophisticated social engineering tactic designed to exploit user trust in familiar platforms. Infrastructure analysis reveals multiple concerning indicators. The domain was registered through Tucows Domains Inc. on February 21, 2026, with an SSL certificate issued by Google Trust Services (WR1). It resolves to IP address 216.198.79.67 within Amazon.com, Inc.'s AS16509 network in the United States. Detection metrics show 21 out of 95 security vendors on VirusTotal flagging the domain as malicious, while Google Safe Browsing specifically classifies it as phishing. The domain appears on one security blocklist and is currently blocked by PhishDestroy, though it remains operational at the time of analysis. Organizations should implement immediate mitigation measures against this credential theft campaign. Network-level protections should include DNS filtering to block resolution of netflix-clone-beta-sand.vercel.app and IP-based blocking of 216.198.79.67. Endpoint security solutions should be configured to detect and prevent access to domains registered through Tucows that exhibit brand impersonation characteristics. User awareness training should emphasize verification of domain legitimacy before entering credentials, particularly when redirected from unexpected login prompts. Security teams should monitor for authentication attempts originating from this infrastructure and implement multi-factor authentication requirements for all Apple ID access attempts.