netflix-clone-five-iota[.]vercel[.]app

This domain is classified as a high-risk credential harvesting site targeting users of a major streaming platform. Analysis indicates it is designed to impersonate the official login interface of Netflix, likely to capture sensitive user credentials such as email addresses and passwords. The threat type is confirmed as generic phishing with a focus on credential theft, a common vector for account takeovers and subsequent fraudulent activity. Infrastructure analysis reveals the domain netflix-clone-five-iota.vercel.app is registered through Vercel Inc. and currently resolves to the IP address 216.198.79.195. The domain was created on June 12, 2026, and remains active despite being flagged by 24 out of 95 security vendors on VirusTotal. It is blocked by at least one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate is issued by Google Trust Services under the identifier WR1, which does not mitigate the malicious nature of the domain. Mitigation steps for this threat include immediate blocking of the domain and its resolving IP address at the network perimeter. Security teams should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate fingerprint into endpoint detection and response (EDR) systems and security information and event management (SIEM) solutions. Users who may have interacted with the domain should be instructed to reset their credentials on the legitimate platform using multi-factor authentication (MFA) and monitor their accounts for unauthorized activity. Organizations should also review logs for any connections to 216.198.79.195 or attempts to access netflix-clone-five-iota.vercel.app to identify potentially compromised accounts.