movies-ui-liard[.]vercel[.]app

This domain, movies-ui-liard.vercel.app, is identified as a high-risk phishing site specifically designed to impersonate the Netflix login interface. Analysis indicates the page title is explicitly labeled 'Netflix-Clone,' suggesting an intent to deceive users into entering legitimate credentials into a fraudulent portal. Such impersonation attacks typically harvest login details for subsequent unauthorized account access, financial fraud, or credential resale on underground markets. The threat is compounded by the domain's active status and its hosting on a platform commonly used for rapid deployment of malicious content, increasing the risk of widespread exposure to unsuspecting users. Technical indicators confirm the malicious nature of this domain. The domain was created on March 07, 2026, and is registered through Vercel Inc., a provider frequently abused for phishing campaigns due to its ease of use and free hosting capabilities. As of the latest assessment, the domain appears on one security blocklist and is flagged by 22 out of 95 security vendors on VirusTotal, indicating moderate to high detection confidence. The domain resolves to the IP address 216.198.79.67, hosted under AS16509 (Amazon.com, Inc.), with an SSL certificate issued by Google Trust Services (WR1). These infrastructure details align with patterns observed in other phishing operations, where legitimate-looking certificates and reputable hosting providers are exploited to lend credibility to fraudulent sites. Users who have visited movies-ui-liard.vercel.app or entered credentials on the site should take immediate remedial action. First, cease all interaction with the domain and avoid clicking any links or downloading content from it. If login details were submitted, change the compromised credentials on the legitimate Netflix platform and any other services where the same credentials may have been reused. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions, and report the incident to the appropriate platform or cybersecurity response team. Organizations should update their security blocklists to include this domain and its associated IP address to prevent further exposure.