netflix-clone-eight-teal[.]vercel[.]app

The domain netflix-clone-eight-teal.vercel.app is actively engaged in brand impersonation, specifically targeting Apple. Analysis confirms the domain is operational and designed to deceive users into believing they are interacting with legitimate Apple services. The page title, "Netflix Clone," contradicts the claimed impersonation target, suggesting either misdirection or a hastily repurposed infrastructure component. This domain remains unresolved as of the latest verification, posing a persistent risk to users who may encounter it through phishing campaigns or malicious redirects. Technical indicators reveal multiple red flags. The domain is flagged by 19 of 95 security vendors on VirusTotal, indicating broad consensus on its malicious nature. It is registered through Tucows Domains Inc. and was created on February 21, 2026, though this date may reflect backdating or administrative manipulation. The domain resolves to the IP address 216.198.79.3, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. It appears on one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate is issued by Google Trust Services (WR1), which, while legitimate, does not mitigate the domain's fraudulent intent. The discrepancy between the page title and the impersonated brand further underscores the domain's deceptive design. Current status confirms the domain remains active and unresolved, continuing to present a high-risk threat to users. Organizations and individuals are advised to block this domain at the network level and update endpoint protection rules to include it in deny lists. Users who may have interacted with this domain should immediately revoke any active sessions, reset credentials for Apple services, and monitor accounts for unauthorized activity. Security teams should investigate logs for connections to 216.198.79.3 or related domains, particularly those hosted on Vercel or similar cloud platforms. Given the domain's use of cloud infrastructure, additional related subdomains may emerge, warranting proactive monitoring of newly observed domains with similar naming patterns or hosting providers.