netflix-clone-beryl-three[.]vercel[.]app

The domain netflix-clone-beryl-three.vercel.app is an active high-risk brand impersonation phishing domain that specifically targets Apple users, despite its misleading page title claiming to be Netflix India. This domain remains operational as of the latest check and poses a significant threat to individuals who may mistake it for a legitimate Apple service. The domain's current status as active means that users can still be directed to it through phishing emails or malicious links, potentially leading to credential theft or other forms of fraud.

Technical analysis reveals that netflix-clone-beryl-three.vercel.app has been flagged by 23 of 95 security vendors on VirusTotal, indicating widespread recognition as malicious. The domain was registered through Tucows Domains Inc. on February 21, 2026, and resolves to the IP address 216.198.79.131. Its SSL certificate is issued by Google Trust Services / WR1, which may lend a false sense of legitimacy. Google Safe Browsing also flags the domain for phishing, and it appears on one security blocklist. The combination of these indicators confirms the domain's malicious nature and high risk level.

Given that this domain is still active and impersonates Apple, users are strongly advised to avoid any interaction with it. PhishDestroy recommends that users do not visit the domain, click on links from unknown sources claiming to be Apple, and report any suspicious emails or messages to Apple's security team. Organizations should block this domain at the network level and educate users about the dangers of brand impersonation phishing. Immediate action is necessary to mitigate the risk of credential theft and other security breaches.