netflix-clone-kappa-six[.]vercel[.]app

This domain, netflix-clone-kappa-six.vercel.app, is actively impersonating Netflix as of July 12, 2026, and has been classified as a high-risk credential phishing site. The domain was registered on February 26, 2026, through Vercel Inc. and resolves to the IP address 216.198.79.131. Analysis of the infrastructure reveals the use of Node.js, React, Next.js, and Webpack, with HSTS enabled and a valid SSL certificate issued by Google Trust Services. The page title, 'Netflix-Clone,' further confirms the intent to mimic the Netflix brand for malicious purposes. Security vendors have flagged this domain consistently, with 16 out of 95 vendors on VirusTotal identifying it as malicious. It appears on at least one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft and 1/100 by Scamadviser, indicating a high likelihood of fraudulent activity. The domain remains active, suggesting ongoing phishing operations targeting users of the Netflix platform. While the exact phishing kit or campaign tactics are not publicly documented, the combination of brand impersonation, low trust scores, and detection by multiple security vendors provides strong evidence of malicious intent. Defenders should prioritize blocking this domain at the network and endpoint levels, particularly in environments where Netflix credentials are used. Monitoring for similar Vercel-hosted subdomains with 'netflix-clone' or comparable naming patterns may help identify related threats. The use of Vercel's hosting infrastructure is notable, as it provides attackers with a low-cost, scalable platform that can be rapidly deployed and abandoned. Organizations should consider implementing stricter controls on traffic to third-party hosting services, especially those frequently abused for phishing. User awareness training should emphasize the risks of entering credentials on any site that does not explicitly match Netflix's official domain structure.