clonix[.]vercel[.]app

This domain, clonix.vercel.app, is flagged as a high-risk brand impersonation threat targeting Apple users. Analysis indicates the site presents a fraudulent login interface designed to harvest credentials, likely deploying a credential harvester or phishing kit. The page title, "Netflix Clone – Watch TV Shows Online, Watch Movies Online," appears unrelated to Apple, suggesting obfuscation or misdirection to evade detection. No explicit drainer kit signatures were identified, but the domain’s infrastructure aligns with credential theft operations. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 216.198.79.3 (AS16509, Amazon.com, Inc.) and was registered through Vercel Inc. on February 27, 2026, an anomalous future date likely indicating falsified registration data. VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists (PhishDestroy and PhishingDB) and is secured with an SSL certificate issued by Google Trust Services (WR1). No Google Safe Browsing (GSB) detection was explicitly noted in the available data. As of the latest assessment, clonix.vercel.app remains active and unresolved. The domain’s SSL certificate and hosting on a reputable provider (Vercel) may lend a false sense of legitimacy to unsuspecting users. Recommended response actions include blocking the domain at the DNS or proxy level, alerting affected users to reset credentials if exposed, and monitoring for secondary payload delivery. The remaining risk is classified as high due to the domain’s active status, confirmed blocklist presence, and the potential for credential compromise.