netflix-clone-ruby-six[.]vercel[.]app

On 29 July 2026, the domain netflix-clone-ruby-six.vercel.app was observed as an active high‑risk phishing infrastructure. Registration records show the domain was provisioned through Vercel Inc., a cloud‑hosting platform that offers on‑demand deployment of web applications. DNS resolution points to the IPv4 address 64.29.17.195, which is currently the sole host associated with the domain. VirusTotal analysis returned a detection rate of 17 out of 91 scanned security vendors, indicating that a significant minority of scanners identified malicious behavior. Google Safe Browsing classifies the site under the “social engineering” category, a label commonly applied to credential‑harvesting pages.

The domain appears on one external blocklist and is actively blocked by the PhishDestroy service, confirming that at least one third‑party threat‑intel provider has taken mitigation action. No public evidence was found regarding the site’s SSL certificate, HTTP response codes, page title, or the specific phishing kit employed. Consequently, the exact content and technique used to lure victims remain uncertain. Likewise, the broader command‑and‑control infrastructure, if any, has not been disclosed.

Defenders should treat the domain as hostile: network‑level filters ought to deny outbound or inbound traffic to 64.29.17.195, and DNS resolvers should be configured to return NXDOMAIN or a sinkhole address for the domain. Continuous monitoring of Vercel‑hosted subdomains is advised, as the platform’s rapid provisioning capabilities enable the rapid creation of look‑alike sites. Organizations should also update endpoint protection signatures to include the 17 VirusTotal detections and ensure that web‑gateway policies block URLs flagged by Google Safe Browsing for social engineering. Incident response teams should collect any potential email or URL artifacts that reference the domain for further forensic analysis.