rita1[.]vercel[.]app

This domain is flagged as a high-risk credential phishing site targeting streaming service users. Analysis indicates the infrastructure is designed to mimic legitimate login portals, specifically impersonating Netflix authentication pages as evidenced by the page title 'Netflix Clone'. The threat type is classified as generic_phishing with a focus on credential harvesting, posing significant risk to end-users who may inadvertently disclose sensitive account information. Infrastructure analysis reveals the domain rita1.vercel.app was registered on April 19, 2026, through Vercel Inc. and currently resolves to the IP address 64.29.17.131, located in the United States. The SSL certificate is issued by Google Trust Services under the WR1 root, which while legitimate, does not mitigate the malicious intent of the domain. Security vendor detections on VirusTotal report 7 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The page title 'Netflix Clone' further corroborates the phishing intent, aligning with known tactics used in credential theft campaigns. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address at the network perimeter. Security teams should deploy indicators of compromise (IOCs) including the domain rita1.vercel.app, IP 64.29.17.131, and SSL certificate thumbprint into endpoint detection and response (EDR) systems and web proxies. User awareness training should emphasize verification of URL authenticity before entering credentials, particularly for domains mimicking popular streaming services. Organizations should monitor for unauthorized access attempts originating from internal networks to Netflix or similar platforms, as compromised credentials may be leveraged for further attacks.