netflix-clone-project-zeta[.]vercel[.]app

The domain netflix-clone-project-zeta.vercel.app is an active phishing site specifically designed to impersonate Netflix, a major streaming service. Analysis confirms this as a brand impersonation threat, where attackers replicate the legitimate Netflix interface to harvest user credentials, payment details, or other sensitive information. The domain remains operational as of the latest verification, posing an ongoing risk to unsuspecting users. Technical indicators reveal multiple red flags. The domain is flagged by 20 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It is registered through Vercel Inc., a platform commonly used for hosting both legitimate and fraudulent projects. The site resolves to the IP address 64.29.17.67, located in the United States under AS16509 (Amazon.com, Inc.). The SSL certificate is issued by Google Trust Services (WR1), which, while valid, does not mitigate the phishing risk. The domain appears on at least one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. The page title, 'Netflix Clone Project,' further corroborates the intent to deceive users by mimicking the Netflix brand. Current status confirms the domain is still active, with no evidence of takedown or remediation. Users are advised to avoid interacting with this domain entirely. Organizations should update web filters and security policies to block access to netflix-clone-project-zeta.vercel.app and monitor for similar patterns, such as Vercel-hosted domains impersonating well-known brands. Individuals who may have entered credentials or payment details on this site should immediately change their passwords, enable multi-factor authentication, and review financial statements for unauthorized activity. Security teams are encouraged to correlate this domain with other Netflix-themed phishing campaigns to identify broader attack infrastructure.