netflix-clone-sigma-gules[.]vercel[.]app

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Netflix users. Analysis indicates the infrastructure was designed to deceive victims into believing they were accessing legitimate Netflix services, likely for credential theft or account compromise. The impersonation focused on Netflix India, as evidenced by the page title 'Netflix India' and the domain's operational characteristics. Infrastructure analysis reveals the domain was registered through Vercel Inc. and resolved to IP address 216.198.79.131, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate was issued by Google Trust Services (WR1), a common pattern observed in phishing campaigns leveraging legitimate certificate authorities. At the time of detection, 24 out of 95 security vendors on VirusTotal flagged this domain as malicious. The domain appears on two security blocklists: PhishDestroy and PhishingDB. No creation date is available, but the domain has since been taken offline, indicating possible takedown action or voluntary suspension by the hosting provider. Organizations and users should implement the following mitigation measures specific to brand impersonation threats. First, block the domain and associated IP address (216.198.79.131) at the network perimeter to prevent any residual access. Second, monitor for credential reuse or unauthorized access attempts from accounts that may have interacted with this domain, particularly those associated with Netflix services. Third, conduct user awareness training focused on identifying brand impersonation tactics, such as unusual subdomains (e.g., 'netflix-clone-sigma-gules'), mismatched SSL certificates, or unexpected regional page titles. Finally, implement multi-factor authentication (MFA) for all accounts to mitigate the impact of potential credential theft, even if the domain is no longer active.