netflix-clone-pujovic[.]vercel[.]app

The domain netflix-clone-pujovic.vercel.app was registered on February 23, 2026 through Tucows Domains Inc. and resolves to the IP address 216.198.79.67, which belongs to the Amazon.com, Inc. network (AS16509) located in the United States. The site returned HTTP status code 451, indicating that the content was unavailable for legal reasons, and the SSL certificate was issued by Google Trust Services under the WR1 label, confirming proper TLS deployment. Technical fingerprints reveal a modern web stack comprised of Node.js, React, Next.js, Vercel hosting, HSTS enforcement, and Webpack bundling, all consistent with a dynamically generated application rather than a static counterfeit page.

The page title "Netflix Clone - Login/Register" and the classification as brand impersonation align the infrastructure with a targeted effort to mimic the Netflix brand. Security telemetry shows that 19 of 95 VirusTotal scanners flagged the domain, and it is currently listed on one external blocklist, specifically PhishDestroy, which has taken the domain offline. Additionally, Gridinsoft assigned a trust score of 0 out of 100, indicating maximal suspicion.

While the domain is no longer reachable, the combination of a recent registration, Amazon-hosted IP, low trust rating, multiple vendor detections, and explicit brand impersonation suggests a high likelihood of malicious intent aimed at credential harvesting. Defenders should continue to block the domain at network perimeters, update URL filtering policies to include the host and its IP range, and monitor for any similar subdomains that reuse the same Vercel deployment pattern. Threat intelligence feeds should be refreshed to capture any re‑registration attempts, and incident response teams should advise users to report unsolicited login prompts claiming to be from Netflix, referencing the observed page title as a known indicator of compromise.