netflix-clone-sandy-eight-15[.]vercel[.]app

This domain, netflix-clone-sandy-eight-15.vercel.app, is identified as a high-risk credential phishing site specifically targeting Netflix users. Analysis indicates the infrastructure was designed to impersonate the official Netflix login portal, likely to harvest user credentials, payment details, or other sensitive information. The domain exhibits classic brand impersonation characteristics, including the use of the Netflix name in conjunction with a third-party hosting provider, which is a common tactic to evade initial detection and lend false legitimacy to the phishing attempt. No specific drainer kit signatures have been confirmed, but the domain’s structure and behavior align with known credential theft campaigns. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered through Tucows Domains Inc. on February 21, 2026, an unusually future-dated creation that may indicate an attempt to bypass reputation-based filters. It resolves to the IP address 64.29.17.3, associated with AS16509 (Amazon.com, Inc.) in the United States. Google Safe Browsing has flagged the domain as phishing, and it is currently detected by 18 out of 95 security vendors on VirusTotal. The domain appears on two security blocklists and is actively blocked by at least two threat intelligence platforms. The SSL certificate is issued by Google Trust Services (WR1), which, while legitimate, is frequently exploited by phishing sites to create a false sense of security. As of the latest assessment, the domain is offline with a page title reading 'Deployment Unavailable,' suggesting either a takedown or temporary suspension. However, the residual risk remains elevated due to the domain’s recent activity and the potential for re-deployment under the same or similar infrastructure. Users who may have interacted with this domain are advised to immediately reset their credentials, monitor for unauthorized transactions, and review connected accounts for signs of compromise. Organizations should update their blocklists to include this domain and its associated IP address to prevent future access attempts. Continuous monitoring of related infrastructure is recommended, as threat actors often re-use hosting providers and registration patterns in subsequent campaigns.