netflix-clone-blond-gamma[.]vercel[.]app

This domain, netflix-clone-blond-gamma.vercel.app, is flagged as a high-risk brand impersonation operation targeting Netflix users. Analysis indicates the infrastructure is designed to mimic the legitimate Netflix login and content portal, likely to harvest user credentials or payment details. The page title, 'Home - Netflix,' reinforces the deception by replicating the authentic Netflix interface, increasing the likelihood of successful social engineering. No cryptocurrency drainer kit signatures were detected, suggesting the primary objective is credential theft rather than direct financial exfiltration via blockchain transactions. Infrastructure analysis reveals the domain was registered through Vercel Inc., a platform commonly abused for rapid deployment of phishing pages due to its ease of use and free hosting capabilities. The domain resolves to the IP address 216.198.79.3, geolocated within the United States under AS16509 (Amazon.com, Inc.). As of the latest scan, 23 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while it appears on one additional security blocklist. The SSL certificate is issued by Google Trust Services (WR1), which, while providing encryption, does not validate the legitimacy of the site’s content. No creation date metadata was provided, but the domain remains operational and unblocked by major browser-based protection mechanisms such as Google Safe Browsing. The domain remains active and continues to pose a significant risk to end users, particularly those unfamiliar with identifying cloned interfaces. Response actions by security vendors have been limited, with only one known blocklist (PhishDestroy) currently mitigating exposure. The combination of a convincing Netflix impersonation, minimal detection coverage, and reliance on a reputable hosting provider increases the likelihood of sustained victim engagement. Users are advised to verify domain authenticity by cross-referencing URLs with official Netflix communications, enabling multi-factor authentication on streaming accounts, and reporting suspicious domains to their security providers. Organizations should update email and web filtering rules to block this domain and monitor for related infrastructure leveraging the same registrar or hosting patterns.