netflix-clone-teal-iota[.]vercel[.]app

PhishDestroy identifies netflix-clone-teal-iota.vercel.app as an active brand impersonation scam masquerading as Netflix to harvest user credentials. The domain leverages Vercel’s hosting infrastructure to deploy a fraudulent login page that closely mimics the legitimate Netflix interface, tricking visitors into disclosing their account credentials. Once harvested, these credentials can be abused for account takeovers, financial fraud, or resold on dark web marketplaces. The threat actor’s use of Vercel’s free tier and SSL certificate from Google Trust Services adds false legitimacy, increasing the likelihood of victim engagement. This domain was flagged by Google Safe Browsing under the SOCIAL_ENGINEERING category with 0 detections on VirusTotal, indicating it has evaded automated detection systems. It resolves to IP 216.198.79.195 and was registered through Vercel Inc., a legitimate hosting provider exploited for malicious purposes. The absence of detections on VirusTotal suggests this campaign is either newly deployed or employs evasion techniques to bypass signature-based scanning. Such low-detection rates are common in early-stage phishing operations that rely on freshly registered domains and legitimate hosting services to appear benign. If you visited netflix-clone-teal-iota.vercel.app, assume your Netflix credentials may have been compromised. Immediately change your Netflix password using the official website (netflix.com) and enable two-factor authentication. Review recent login activity for unauthorized access and revoke any unfamiliar sessions. If you reused the same password on other services, update those accounts immediately as well. Avoid clicking links in unsolicited emails or messages claiming to be from Netflix, as these are likely part of coordinated credential harvesting campaigns. Report the domain to Google Safe Browsing and your organization’s security team if applicable. Monitor financial accounts for unusual activity linked to this scam.