netflixclonee[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat targeting Netflix. Analysis indicates the site was designed to deceive users into believing it was an official Netflix platform, likely for credential harvesting or fraudulent subscription schemes. The threat type is classified as brand impersonation, a tactic frequently employed to exploit trust in well-known brands for malicious purposes. Infrastructure analysis reveals the domain netflixclonee.vercel.app was registered through Tucows Domains Inc. on February 21, 2026, an unusually future-dated registration that may indicate an attempt to evade detection or prolong malicious activity. It resolves to the IP address 216.198.79.131, hosted under AS16509 (Amazon.com, Inc.) in the United States. The domain is flagged by 17 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly marking it as phishing. Additionally, it appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WR1), a common but not exclusive indicator of legitimacy, often exploited by threat actors to lend false credibility. The page title, Deployment Unavailable, suggests the site may have been taken offline either by the hosting provider or due to enforcement actions, though residual risk remains. Mitigation steps for this type of threat include immediate blacklisting of the domain and its associated IP address across all security gateways and endpoint protection systems. Organizations should monitor for any residual DNS queries or connections to the IP 216.198.79.131, as this may indicate compromised systems attempting to reach the malicious infrastructure. Users who may have interacted with the domain should be advised to reset credentials for Netflix and any other accounts where identical or similar passwords were used. Security teams should review logs for signs of credential harvesting activity, particularly focusing on timeframes when the domain was active. Additionally, domain registrars and hosting providers should be notified of the abuse to prevent re-registration or re-hosting of the malicious content under a different name.