netflix-clone-navy-beta[.]vercel[.]app

This domain is classified as a high-risk credential harvesting site targeting Apple users through brand impersonation. Analysis indicates the domain netflix-clone-navy-beta.vercel.app presents itself as a Netflix login portal while specifically targeting Apple account credentials, a tactic commonly used to bypass user vigilance by exploiting trusted streaming service branding. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 22 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. It appears on one security blocklist and is actively blocked by PhishDestroy. The domain resolves to IP address 216.198.79.67, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. Registration is attributed to Vercel Inc., and the SSL certificate is issued by Google Trust Services (WR1). The page title displays 'Netflix- Watch TV Shows Online, Watch Movies Online,' which directly contradicts the Apple brand impersonation observed in credential harvesting attempts. The domain remains active at the time of assessment. Mitigation requires immediate action from network defenders and end users. Organizations should implement DNS-level blocking for netflix-clone-navy-beta.vercel.app and its resolving IP 216.198.79.67. Security teams should monitor for connections to this IP and domain in proxy logs, particularly from endpoints accessing Apple services. End users should be alerted to verify domain authenticity before entering credentials, especially when redirected from unexpected login prompts. Given the Netflix branding discrepancy, security awareness training should emphasize cross-verifying page titles with expected service providers. Certificate transparency logs should be monitored for similar patterns using Google Trust Services WR1 certificates on Vercel-hosted domains.