netflix-clone-6[.]vercel[.]app

This domain, netflix-clone-6.vercel.app, is flagged as a high-risk brand impersonation site targeting Apple users. Analysis indicates the threat type is specifically brand impersonation, not credential theft or a crypto drainer. The page title displays "Netflix," creating a misleading association with a legitimate streaming service while attempting to exploit Apple’s branding for malicious purposes. No drainer kit signatures have been observed in initial scans, but the domain’s infrastructure and content are designed to deceive users into believing they are interacting with an official Apple service or affiliated platform. Infrastructure analysis reveals the following technical indicators: the domain is registered through Vercel Inc. and resolves to IP address 216.198.79.67, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate is issued by Google Trust Services (WR1), which does not mitigate the phishing risk. Google Safe Browsing has flagged the domain as phishing, and it appears on two security blocklists. VirusTotal reports 25 out of 95 security vendors detecting the domain as malicious. The domain remains active and has not been taken down by the registrar or hosting provider at the time of this analysis. Current status confirms the domain is still active and operational, posing an ongoing risk to users. Response actions by security vendors include blocking by PhishDestroy and PhishingDB, but no takedown has been enforced. The remaining risk is high due to the domain’s persistence, the use of a trusted hosting provider, and the mismatch between the displayed brand (Netflix) and the intended target (Apple). Organizations and users are advised to block the domain at the network level, update endpoint protection rules to include this indicator, and monitor for related infrastructure. Users should be educated on recognizing brand impersonation tactics, particularly those leveraging mismatched service names and trusted hosting platforms.