netflix-clone-jade-mu[.]vercel[.]app

This domain, netflix-clone-jade-mu.vercel.app, is actively engaged in brand impersonation targeting Netflix. Analysis indicates the site presents itself as a Netflix clone, likely designed to deceive users into entering credentials or payment details under false pretenses. The page title explicitly reads 'Netflix Clone,' reinforcing the intent to mimic the legitimate streaming service. No evidence of a crypto drainer or malware payload was observed, but the site’s infrastructure aligns with credential harvesting tactics. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain was registered on February 21, 2026, through Tucows Domains Inc., an uncommon registrar for such activity. It resolves to the IP address 216.198.79.195, hosted on Amazon.com, Inc.’s AS16509 network in the United States. Security vendors have flagged the domain in 21 out of 95 VirusTotal scans, while Google Safe Browsing explicitly designates it as phishing. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WR1), a common but not exclusive provider for malicious sites. As of the latest assessment, the domain remains active and unmitigated. While some security providers have blocked access via the PhishDestroy list, the site continues to resolve and remains accessible to unprotected users. The remaining risk is classified as high due to the combination of active impersonation, credential theft potential, and limited takedown progress. Users are advised to avoid interaction, verify URLs against official sources, and report the domain to their security providers for broader blocking. Organizations should monitor for related infrastructure, such as subdomains or associated IPs, to preempt further abuse.