netflix-ui-clone-india[.]vercel[.]app

This domain, netflix-ui-clone-india.vercel.app, is actively engaged in brand impersonation targeting Apple users. Analysis indicates the site is designed to harvest Apple ID credentials through a fraudulent login interface, currently operational and accessible. The threat type is classified as credential theft via brand spoofing, with Apple as the primary target. Infrastructure analysis reveals the domain is registered through Vercel Inc. and resolves to IP address 216.198.79.195, hosted on Amazon.com, Inc. infrastructure (AS16509). The SSL certificate is issued by Google Trust Services (WR1). Security vendors have flagged this domain, with 21 out of 95 VirusTotal engines detecting malicious activity. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is explicitly labeled as phishing by Google Safe Browsing. The page title, 'Document,' further suggests an attempt to disguise the malicious intent under a generic label. The domain remains active as of the latest verification, posing an ongoing risk to users who may encounter it through phishing campaigns. Organizations and individuals are advised to implement immediate countermeasures, including blocking the domain at the network level and adding it to endpoint protection rules. Users should be educated to recognize brand impersonation tactics, particularly those involving login prompts from unofficial domains. Monitoring for related infrastructure, such as associated IP ranges or additional Vercel-hosted subdomains, is recommended to identify and mitigate further threats from this actor.