netflix-app-react-nine[.]vercel[.]app

This domain is flagged as a high-risk credential phishing site targeting streaming service users. Analysis indicates the infrastructure is designed to harvest Netflix account credentials through a deceptive login interface, presenting an immediate threat to user data security. Infrastructure analysis reveals the domain netflix-app-react-nine.vercel.app was registered through Vercel Inc. and resolves to the IP address 64.29.17.3, geolocated to the United States. The domain was created on March 31, 2026, with an SSL certificate issued by Google Trust Services (WR1). Security detection engines report 15 out of 95 vendors flagging the domain on VirusTotal, while it appears on one security blocklist and is actively blocked by a phishing-specific detection system. The page title explicitly displays 'NETFLIX,' reinforcing its impersonation of the legitimate streaming platform. To mitigate risks associated with this credential phishing campaign, users should avoid interacting with the domain entirely. Organizations should implement DNS-based blocking for 64.29.17.3 and netflix-app-react-nine.vercel.app at the network perimeter. Endpoint protection systems should be updated to recognize the domain's SSL certificate fingerprint and page title as indicators of compromise. Users who may have entered credentials should immediately reset passwords via the official Netflix platform and enable multi-factor authentication where available.