netflix-clone-1w2d[.]vercel[.]app

Analysis of netflix-clone-1w2d.vercel.app indicates a high‑risk brand‑impersonation campaign targeting Netflix. The domain was created on 21 February 2026 and registered through Tucows Domains Inc. It resolves to the IP address 216.198.79.131, which belongs to Amazon.com, Inc. (AS16509) in the United States. The web server returns an HTTP 451 status code and the page title “Deployment Unavailable”, confirming that the malicious payload has been taken offline at the time of observation. TLS termination is performed by a Google Trust Services certificate issued to “WR1”, demonstrating the use of a legitimate certificate authority.

Infrastructure fingerprints reveal the presence of Vercel hosting and HTTP Strict Transport Security (HSTS) headers. VirusTotal records show that 15 of 93 scanned security vendors flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat. The domain appears on one security blocklist and has been reported to PhishDestroy, which has already blocked it. The combination of a recent registration date, Amazon‑backed hosting, a trusted SSL certificate, and multiple vendor detections aligns with tactics commonly observed in brand‑impersonation operations.

The exact malicious content remains unknown because the site currently serves only a deployment‑unavailable page, leaving the specific phishing vector unverified. Defenders should add the domain to outbound filtering and DNS‑sinkhole rules, monitor queries to the associated IP address, and consider extending blocklist coverage to include the broader Vercel and Amazon IP ranges. Continuous re‑evaluation is advised in case the site is re‑activated, and threat‑intel sharing of the observed indicators is recommended.