netflix-clone-sable-delta[.]vercel[.]app

This domain, netflix-clone-sable-delta.vercel.app, is currently flagged as high‑risk generic phishing and remains active as of the report date 2026-07-29. Google Safe Browsing classifies the site under the social‑engineering category, indicating it is likely used to harvest credentials or personal data. The domain was registered through Vercel Inc., a legitimate cloud‑hosting provider that often supplies dynamic DNS for short‑lived projects, which can obscure attribution. Infrastructure analysis shows the domain resolves to the IPv4 address 216.198.79.195; no additional A or AAAA records were observed. VirusTotal scans report that 20 of 91 security vendors have raised detections against the domain, reflecting a notable level of consensus among anti‑malware engines.

The domain appears on a single external security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing its malicious reputation. Nameserver resolution failed (NS_NOT_FOUND), suggesting the domain’s DNS configuration may be transient or intentionally hidden. Evidence gaps include the absence of a documented SSL certificate fingerprint, missing HTTP response details, and no publicly available page title or content snapshot, limiting a full content‑based assessment. Given the domain’s naming pattern, it appears designed to mimic the legitimate Netflix brand, a common tactic to increase user trust. Although the actual page content has not been captured, the presence of social‑engineering flags and multiple vendor detections strongly suggest a credential‑stealing lure.

The lack of a stable nameserver record may also indicate rapid redeployment, a behavior observed in other phishing campaigns hosted on serverless platforms. Analysts should therefore treat any network traffic to or from this host as suspicious.