netflix-clone-rust-five[.]vercel[.]app

This domain, netflix-clone-rust-five.vercel.app, is identified as a high-risk brand impersonation threat targeting Apple users. Analysis indicates the site presents a fraudulent login interface under the guise of a Netflix-related service, likely designed to harvest credentials or distribute malicious payloads. The domain does not appear to host a cryptocurrency drainer kit but instead focuses on credential theft through brand deception, leveraging Apple's reputation to lower user vigilance.

Technical indicators confirm the domain's malicious nature. VirusTotal reports 22 out of 95 security vendors flagging the domain as malicious. The domain was registered through Vercel Inc. on March 06, 2026, and resolves to the IP address 216.198.79.3, hosted on Amazon.com, Inc. infrastructure (AS16509). Google Safe Browsing has classified the domain as phishing, and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WR1), a common tactic to lend false legitimacy to phishing sites.

As of the latest verification, the domain remains active and unmitigated. The page title 'NetFlix' further corroborates the attempt to mislead users into believing they are interacting with a legitimate streaming service. Immediate response actions should include blocking the domain at the DNS or network level, invalidating any credentials potentially exposed to this domain, and monitoring for secondary infections. The remaining risk is high due to the domain's continued operation, the use of trusted infrastructure, and the low detection rate among some security vendors.