netflix-clone-umber-gamma[.]vercel[.]app

On July 23, 2026 analysts observed that the domain netflix-clone-umber-gamma.vercel.app was taken offline but remains a high‑risk brand‑impersonation site. The domain was registered on March 08, 2026 through Vercel Inc. and resolves to the IP address 216.198.79.195, which is hosted in the United States under ASN 16509 owned by Amazon.com, Inc. The site presented an SSL certificate issued by Google Trust Services (WR1), suggesting an attempt to lend legitimacy to the connection. HTTP responses returned a 451 status code, indicating that the resource is unavailable for legal reasons, and the domain is listed on at least one security blocklist. Google Safe Browsing has flagged the site for social engineering, and PhishDestroy already blocks it.

Reputation services assign extremely low scores: Scamadviser 1/100 and Gridinsoft 0/100. VirusTotal analysis shows that 22 of 94 scanning engines flagged the domain as malicious, reinforcing the suspicion of malicious intent. The page title returned by the server is "Netflix Login Page," yet the listed brand target is Google, and the scam type is identified as a Tech Support Scam. This incongruity between the page title and the impersonated brand implies that the site may be attempting to harvest credentials for multiple services or to lure victims with a deceptive narrative.

The presence of Vercel and HSTS in the technology stack confirms the use of modern hosting infrastructure, which can complicate takedown efforts. Because the site is offline, direct content analysis is not possible, leaving uncertainties about the exact phishing payload or malicious scripts that may have been delivered. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any re‑use, and add the domain to internal threat intelligence feeds. Continuous observation of Vercel‑hosted assets for similar patterns is advised, as the infrastructure may be leveraged for future impersonation campaigns.