netflix-clone-coral-eight[.]vercel[.]app

The domain netflix-clone-coral-eight.vercel.app is identified as a brand impersonation threat targeting Apple. It is currently active and is designed to impersonate a legitimate service, aiming to deceive users into providing sensitive information or credentials. There is no indication of a cryptocurrency drainer kit associated with this domain, suggesting its primary intent is phishing through brand deception.

Technical indicators reveal that the domain has a VirusTotal score of 23/95, indicating that 23 out of 95 security vendors have flagged it for malicious activity. The domain is registered through Vercel Inc. and resolves to the IP address 64.29.17.131, which is located in the United States under AS16509 (Amazon.com, Inc.). The domain was created on March 09, 2026, and is currently listed on one security blocklist, specifically flagged by PhishDestroy. Additionally, the domain is marked by Google Safe Browsing for phishing activity, further corroborating its malicious intent.

Current status indicates that the domain remains active and poses a high risk to users. The presence on a security blocklist, combined with the Google Safe Browsing flag and VirusTotal alerts, suggests that immediate response actions are necessary to mitigate user exposure. Users are advised to exercise caution and avoid any interactions with this domain, as it is likely to be used for illicit purposes. Continuous monitoring of this domain's activity is recommended to assess any changes in risk level or to implement further protective measures.