netmirr[.]vercel[.]app

This domain, netmirr.vercel.app, is flagged as a high-risk generic phishing threat specifically targeting users of the Netflix streaming platform. Analysis indicates the domain hosts a fraudulent login portal designed to harvest user credentials, payment details, and personal information. The page title, 'Netflix - Watch TV Shows Online, Watch Movies Online | Demo,' directly mimics the legitimate Netflix interface, increasing the likelihood of successful deception. No specific drainer kit signatures have been identified, but the domain exhibits characteristics consistent with credential phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain is registered through Vercel Inc. and resolves to the IP address 216.198.79.195. VirusTotal detection shows 19 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services under the common name WR1. No creation date is available in the provided data, but the domain remains actively resolving and serving content. Google Safe Browsing (GSB) status is not explicitly stated, but the presence on a security blocklist and VirusTotal detections confirm its malicious nature. As of the latest assessment, netmirr.vercel.app remains active and continues to pose a significant risk to users. Immediate response actions should include blocking the domain at the DNS or network level, adding it to internal threat intelligence feeds, and alerting users to avoid interaction. The domain's use of a legitimate hosting provider (Vercel) and a valid SSL certificate complicates detection, requiring reliance on advanced threat intelligence and behavioral analysis. Users who may have interacted with this domain should be advised to change their Netflix credentials immediately, enable multi-factor authentication, and monitor their accounts for unauthorized activity. The remaining risk is classified as high due to the domain's active status and the potential for credential theft leading to financial fraud or identity compromise.