netflix-drab-nu[.]vercel[.]app

This domain, netflix-drab-nu.vercel.app, is identified as a high-risk credential theft operation impersonating Netflix. The page title explicitly displays 'Netflix,' and the site is designed to harvest user login credentials through a fraudulent interface mimicking the legitimate streaming platform. No crypto drainer kit signatures were detected, but the domain exhibits classic indicators of a credential harvesting phishing campaign, including cloned branding and input forms for sensitive data submission. Analysis indicates the domain resolves to IP address 216.198.79.67 and was registered through Vercel Inc. on June 12, 2026, though the discrepancy in the creation date suggests potential manipulation or misreporting. The domain appears on one security blocklist and is flagged by 19 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WR1), which may lend a superficial appearance of legitimacy. Google Safe Browsing does not currently list the domain, but the presence on PhishDestroy’s blocklist confirms its malicious classification. As of the latest verification, netflix-drab-nu.vercel.app remains active and continues to pose a significant risk to users. Response actions include submission to security blocklists and automated takedown requests, though the domain’s persistence suggests evasion tactics or delayed enforcement. Users are advised to avoid interacting with the site, verify URLs before entering credentials, and report any suspicious activity to their security teams. Organizations should update web filters to block the domain and its associated IP address to mitigate exposure.