net1[.]vercel[.]app

This domain, net1.vercel.app, is identified as a high-risk brand impersonation threat targeting Netflix. Analysis indicates the site replicates Netflix’s login interface and branding, likely aiming to harvest user credentials or payment details. No specific drainer kit signatures were detected, but the site’s structure aligns with credential theft campaigns commonly associated with streaming service impersonation. The page title explicitly displays 'Netflix,' reinforcing the deception. Infrastructure analysis reveals concrete technical indicators: the domain is flagged by 23 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly labeling it as phishing. Registered through Tucows Domains Inc. on February 21, 2026, the domain resolves to the IP address 216.198.79.67. The SSL certificate is issued by Google Trust Services (WR1), a legitimate provider often exploited in phishing operations. The domain appears on at least one security blocklist, further corroborating its malicious classification. As of the latest assessment, net1.vercel.app remains active, posing an ongoing risk to users. Immediate response actions should include blocking the domain at the DNS level, reporting it to additional threat intelligence platforms, and notifying the hosting provider (Vercel) for takedown. Despite existing detections, the domain’s persistence underscores the need for heightened vigilance. Users are advised to verify URLs before entering credentials and to rely on official channels for accessing Netflix services. The remaining risk level is classified as high due to the domain’s active status and confirmed impersonation tactics.