netflix-clone-delta-hazel[.]vercel[.]app

This domain, netflix-clone-delta-hazel.vercel.app, is actively engaged in brand impersonation targeting Google. Analysis confirms the site is designed to deceive users into believing they are interacting with legitimate Google services, despite displaying a misleading 'Netflix' page title. The domain remains operational and poses a significant threat to users who may unknowingly disclose sensitive credentials or personal information. Infrastructure analysis reveals the domain is registered through Vercel Inc. and resolves to the IP address 216.198.79.67, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate is issued by Google Trust Services under the WR1 intermediate. Security vendor detections are substantial, with 21 of 95 VirusTotal engines flagging the domain as malicious. Additionally, the domain appears on one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. The discrepancy between the page title ('Netflix') and the claimed impersonation target (Google) suggests an attempt to obfuscate the true nature of the threat or to exploit multiple brand associations. The domain remains active as of the latest verification, indicating an ongoing risk. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to include the domain and its associated IP address. Users who may have interacted with this site should immediately reset credentials for any accounts accessed during the suspected compromise. Security teams should monitor for related indicators, including the SSL certificate thumbprint and registrar details, to identify potential copycat domains or infrastructure reuse.