next13-netflix-tau[.]vercel[.]app

Analysis of the domain next13-netflix-tau.vercel.app indicates it was actively impersonating Netflix, a confirmed brand target. The domain was registered on February 21, 2026, through Tucows Domains Inc. and hosted on Amazon.com, Inc. infrastructure (AS16509) with an IP address of 64.29.17.67, located in the US. At the time of assessment, the domain resolved to an HTTP 451 status, a code typically associated with content unavailability due to legal or policy restrictions, and displayed the page title 'Deployment Unavailable.' This suggests the hosting provider or domain registrar may have taken enforcement action to disable the site. Security vendors flagged the domain as malicious, with 16 of 93 engines on VirusTotal detecting it as harmful.

It also appears on at least one security blocklist and was blocked by PhishDestroy. The domain was served with an SSL certificate issued by Google Trust Services (WR1), and HSTS was enforced, which is atypical for phishing infrastructure but not unprecedented. Technologies detected include Vercel, a legitimate hosting platform often abused for rapid deployment of phishing pages. While the domain is currently offline, defenders should treat it as part of a broader Netflix-branded phishing campaign.

Historical DNS and WHOIS records should be preserved for forensic analysis, and any related domains or IPs should be cross-referenced for patterns. If this domain was encountered in logs or user reports, it is recommended to flag associated accounts or sessions for review, particularly those linked to the IP 64.29.17.67 or the Vercel hosting environment. No further details about the phishing kit or user interaction flow are available at this time.