netflix-clone-theta-eight[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat targeting Netflix users. Analysis indicates the infrastructure is designed to harvest login credentials, payment details, and personal information through a fraudulent interface labeled 'Netflix Clone.' The campaign leverages social engineering tactics to deceive victims into entering sensitive data under the guise of a legitimate streaming service. Infrastructure analysis reveals the domain netflix-clone-theta-eight.vercel.app was registered through Tucows Domains Inc. on February 22, 2026, and resolves to the IP address 64.29.17.3, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain appears on one security blocklist and is flagged by 20 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WR1), which, while valid, does not mitigate the malicious intent of the site. Detection metrics indicate a persistent and active threat, with the page title explicitly identifying itself as a 'Netflix Clone.' Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP address (64.29.17.3) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate fingerprint into security monitoring systems to detect and prevent access. End-users should be educated on recognizing phishing attempts, particularly those mimicking streaming services, and advised to verify URLs before entering credentials. If exposure is suspected, affected accounts should be secured by resetting passwords and enabling multi-factor authentication to prevent unauthorized access.