netflixclone-ui[.]vercel[.]app

This domain, netflixclone-ui.vercel.app, is identified as a high-risk phishing resource specifically designed to impersonate the Netflix sign-in portal. Analysis confirms the page title as 'Netflix - Sign In,' indicating an attempt to deceive users into submitting login credentials. The domain remains active as of the latest verification, posing an ongoing threat to unsuspecting users. Infrastructure analysis reveals the domain is hosted on IP address 216.198.79.3, associated with AS16509 (Amazon.com, Inc.) in the United States. The domain is registered through Vercel Inc., a platform commonly used for legitimate web deployments but increasingly exploited for phishing operations. Detection metrics show the domain is flagged by 22 of 95 security vendors on VirusTotal, while Google Safe Browsing explicitly categorizes it as phishing. The SSL certificate is issued by Google Trust Services (WR1), providing a false sense of security. The domain appears on at least one security blocklist, and automated threat intelligence systems have assigned it a unique seed identifier (50104c) for tracking purposes. Current status indicates the phishing page remains operational, continuing to harvest credentials from victims. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include this indicator of compromise. Users who may have interacted with the domain should immediately reset their credentials on the legitimate Netflix platform and enable multi-factor authentication. Security teams are encouraged to monitor for related infrastructure, including subdomains or IP ranges associated with the registrar, as threat actors frequently reuse hosting environments for subsequent campaigns.