netflix-clone-khaki-seven[.]vercel[.]app

This domain, netflix-clone-khaki-seven.vercel.app, is actively engaged in brand impersonation targeting Apple users. The threat type is classified as credential theft through fraudulent brand representation, with the page masquerading as a legitimate Apple service to deceive victims. As of the latest verification, the domain remains operational and unmitigated. Analysis of the domain reveals multiple indicators of malicious activity. The domain is flagged by 22 of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as a phishing site. It appears on one security blocklist and is registered through Vercel Inc., resolving to the IP address 216.198.79.131, hosted under AS16509 (Amazon.com, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WR1), and the domain was created on March 05, 2026. The page title, "Netflix || swamithedev," further suggests an attempt to mislead users by leveraging unrelated branding. Current infrastructure analysis indicates the domain is still active and poses a high risk to users. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Endpoint protection solutions should be updated to include this domain in denylists, and users should be educated on recognizing brand impersonation tactics. Monitoring for similar domains registered through Vercel Inc. or resolving to the same IP range is recommended to preemptively mitigate related threats.