netflix-clone-2r50aerpr-eliasvasquesalcantara[.]vercel[.]app

This domain is an active phishing site impersonating the Netflix brand to deceive users into entering login credentials. The site presents a visually convincing replica of the Netflix login interface, designed to harvest usernames, passwords, and potentially payment details from unsuspecting visitors. Analysis indicates the threat is not limited to credential theft; the infrastructure may also facilitate follow-on attacks such as account takeover or financial fraud. Infrastructure analysis reveals the domain was registered through Vercel Inc. on April 28, 2026, and resolves to the IP address 216.198.79.67, hosted by CYPRESS COMMUNICATIONS, LLC in the United States. The SSL certificate is issued by Google Trust Services under the WR1 intermediate. Detection metrics confirm the site is flagged by 19 out of 95 security vendors on VirusTotal, and it appears on one security blocklist, indicating broad recognition of its malicious nature. Users who have visited this domain should immediately cease all interaction and take corrective actions. Change any passwords entered on the site, especially if reused across other services. Enable multi-factor authentication on all accounts as an additional security layer. Monitor financial statements and account activity for unauthorized transactions. Report the incident to relevant security teams or abuse contacts, including the registrar (Vercel Inc.) and hosting provider, to support takedown efforts. Avoid clicking on any links received via email or messaging platforms that direct to this or similar domains.