netflix-clone-azure-two[.]vercel[.]app

This domain, netflix-clone-azure-two.vercel.app, is identified as an active phishing infrastructure impersonating the Netflix brand. Analysis indicates the page presents a fraudulent login interface designed to harvest user credentials, a common tactic in brand impersonation schemes targeting streaming service subscribers. The domain leverages a cloned Netflix interface, likely deployed through automated phishing kits, to deceive victims into submitting sensitive account details. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 216.198.79.195, hosted on autonomous system AS16509 under Amazon.com, Inc. in the United States. The SSL certificate is issued by Google Trust Services (WR1), a legitimate provider often abused in phishing operations. Detection metrics show 20 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain is registered through Vercel Inc., a platform frequently exploited for rapid phishing deployment. It is currently blocked by two security blocklists, including PhishDestroy and OpenPhish, and is flagged as phishing by Google Safe Browsing. The domain remains active as of this assessment, posing a high risk to unsuspecting users. Response actions should include immediate blacklisting in enterprise security gateways, DNS filtering, and endpoint protection systems. Users are advised to verify domain authenticity before entering credentials, particularly on pages mimicking branded login portals. The remaining risk stems from the domain's continued operation and potential for credential theft, necessitating ongoing monitoring and takedown efforts to mitigate further exposure.