netflix-gui-clone[.]vercel[.]app

Analysis of netflix-gui-clone.vercel.app shows a high‑risk brand‑impersonation site that was taken offline before the report date. The domain was registered on March 08, 2026 through Vercel Inc., and it resolves to the Amazon‑owned IP 64.29.17.3 (AS16509, United States). The TLS certificate is issued by Google Trust Services under the WR1 intermediate, and the site presented HSTS headers, indicating a typical Vercel‑hosted deployment. HTTP responses returned a 451 status code, confirming that the content was unavailable at the time of testing.

The page title returned was "Netflix," while the listed brand target is Apple, and the scam classification is a Tech Support Scam. Scamadviser assigned a trust score of 1 / 100 and Gridinsoft gave 0 / 100, reflecting extreme untrustworthiness. Google Safe Browsing flagged the domain for social engineering, and the site appears on one security blocklist. VirusTotal scans recorded 26 detections out of 94 vendors, reinforcing the malicious assessment.

PhishDestroy has also blocked the domain. Defenders should add the domain and its IP address to internal blocklists, monitor for any resurgence of the sub‑domain on other hosting platforms, and enforce outbound filtering that blocks connections to known Vercel‑hosted malicious sites. Incident response teams should treat any user reports mentioning Apple‑related tech‑support calls originating from this URL as compromised attempts and advise affected users to reset credentials and review recent support interactions. Continuous threat‑intel feeds should be consulted for potential re‑use of the same infrastructure in future campaigns.