netflix-clone-ivory-ten[.]vercel[.]app

Analysis indicates a HIGH risk infrastructure associated with brand_impersonation targeting Apple, delivered through a deceptive “Netflix Clone” themed page. The domain is actively serving content consistent with credential harvesting and user deception.

Telemetry and registration signals reinforce malicious classification: VirusTotal reports 23/95 security vendors flagging the domain. The registration was created on February 21, 2026 and is managed through Tucows Domains Inc. The resolving infrastructure uses IP 64.29.17.67, geolocated in the United States under AS16509 (Amazon.com, Inc.). TLS issuance is attributed to Google Trust Services / WR1. Google Safe Browsing categorizes the domain as phishing, and it appears on at least 1 security blocklist, including detection by PhishDestroy. The current operational status is active. The landing page title is “Netflix Clone,” while threat intelligence indicates impersonation of Apple branding.

Mitigation should include immediate domain blocking at DNS and gateway layers, sinkholing of 64.29.17.67, and addition of indicators to enterprise threat feeds. Users should be warned against entering credentials or Apple IDs, as the page likely harvests authentication data. Security teams should correlate TLS certificate reuse, monitor Tucows-registered domains with similar naming patterns, and deploy browser-level phishing protection. Continuous monitoring is recommended due to active status and confirmed phishing classification.