netflix-clone-proj-oosfcji6s-brunofaria93[.]vercel[.]app

This domain is flagged as a high-risk Netflix brand impersonation threat designed for credential theft. Analysis indicates the site mimics Netflix login interfaces to harvest user account credentials, potentially enabling unauthorized access to subscription services and associated payment data. The threat is classified as active and continues to resolve despite detection by security systems. Infrastructure analysis reveals the domain netflix-clone-proj-oosfcji6s-brunofaria93.vercel.app resolves to IP 64.29.17.195 (US, AS16509 Amazon.com, Inc.) and was registered on February 21, 2026, through Tucows Domains Inc. The page title 'Netflix Clone' confirms the impersonation intent. The domain appears on one security blocklist and is flagged by 20 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WR1), providing a false sense of legitimacy to potential victims. Mitigation requires immediate blocking of the domain and its resolving IP at network perimeter devices. Security teams should deploy indicators of compromise (IOCs) including the domain, IP, and SSL certificate fingerprint to endpoint detection systems. User awareness training should emphasize verification of official Netflix domains (netflix.com) and caution against entering credentials on unverified pages. Financial institutions and identity protection services should monitor for credential reuse stemming from this campaign, particularly for accounts linked to Netflix subscriptions.