movie-streaming-project-rose[.]vercel[.]app

This domain, movie-streaming-project-rose.vercel.app, is flagged for brand impersonation targeting Netflix. Analysis indicates the site mimics Netflix’s official interface, presenting an identical page title, "Netflix," to deceive users into entering credentials or payment details. No crypto drainer kit signatures were observed, but the domain’s design and structure align with credential theft campaigns. The threat actor appears to leverage brand familiarity to harvest sensitive user data, a common tactic in high-risk impersonation schemes. Infrastructure analysis reveals the domain is hosted on 216.198.79.3, an IP address associated with AS16509 (Amazon.com, Inc.) in the United States. The domain was registered through Vercel Inc., a platform frequently abused for rapid deployment of malicious sites. VirusTotal detection shows 22 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WR1), a legitimate provider often exploited to lend false credibility. The domain appears on one security blocklist, and Google Safe Browsing (GSB) status remains unconfirmed at the time of analysis. As of the latest assessment, movie-streaming-project-rose.vercel.app remains active and unmitigated. The domain has been blocked by at least one security provider, but no takedown or sinkholing actions have been observed. The remaining risk is classified as high due to the domain’s active status, low detection rate relative to its potential impact, and the absence of widespread blocking. Organizations are advised to implement DNS-level blocking for 216.198.79.3 and the domain itself, while users should be alerted to verify URLs before entering credentials. Monitoring for similar Vercel-hosted domains impersonating streaming services is recommended to preempt further abuse.