netflix-clone-topaz-kappa[.]vercel[.]app

This domain, netflix-clone-topaz-kappa.vercel.app, operates as a brand impersonation scheme targeting Apple users under the guise of a streaming service. The page displays the title 'NetFlix' and presents a fraudulent interface designed to harvest credentials or distribute malicious payloads by exploiting the trust associated with Apple's brand. Analysis indicates the site is structured to deceive visitors into entering sensitive information, potentially leading to account compromise or financial fraud through social engineering tactics tailored to mimic legitimate streaming platforms. Infrastructure analysis reveals concrete indicators of malicious activity. The domain is flagged by 26 out of 95 security vendors on VirusTotal, with additional detections on two security blocklists, including PhishDestroy and PhishingDB. It resolves to the IP address 64.29.17.3, hosted on Amazon Web Services (AS16509), and is registered through Vercel Inc. Google Safe Browsing has classified the domain as phishing, and the SSL certificate is issued by Google Trust Services, a common characteristic of both legitimate and malicious sites. The domain remains active and unmitigated at the time of assessment. Users who have visited netflix-clone-topaz-kappa.vercel.app should take immediate remediation steps. Disconnect from the site and terminate any active sessions. Clear browser cache and cookies to remove residual tracking elements. If any credentials were entered, reset passwords for the affected accounts and enable multi-factor authentication where available. Monitor financial statements and account activity for unauthorized transactions. Report the domain to local cybersecurity authorities or dedicated phishing reporting platforms to contribute to broader threat mitigation efforts.