netflix-clone-wheat-three[.]vercel[.]app

This domain, netflix-clone-wheat-three.vercel.app, poses a high-risk brand impersonation threat targeting Apple users. The page displays a fraudulent Netflix India interface despite its primary objective of harvesting Apple credentials, indicating a dual-layer deception tactic. Analysis reveals the domain is designed to exploit trust in both Netflix and Apple brands, likely to capture login details, payment information, or other sensitive user data through a fake authentication portal. Infrastructure analysis reveals the domain was registered through Vercel Inc. on March 04, 2026, and currently resolves to IP address 64.29.17.195, hosted on Amazon.com, Inc. infrastructure (AS16509). The domain appears on one security blocklist and is flagged by 19 out of 95 security vendors on VirusTotal as malicious. Google Safe Browsing has classified it as a phishing site, and the SSL certificate is issued by Google Trust Services (WR1), which may lend false legitimacy to the fraudulent page. Users who have visited netflix-clone-wheat-three.vercel.app should immediately terminate any active sessions and avoid entering credentials or personal information. It is recommended to clear browser cache and cookies, run a full antivirus scan, and monitor accounts for unauthorized activity. If credentials were submitted, users should change passwords immediately and enable multi-factor authentication where available. Network administrators should block the domain and its resolving IP (64.29.17.195) at the perimeter to prevent further access.