flix-movie[.]vercel[.]app

Analysis of flix-movie.vercel.app indicates that the domain was registered on February 21, 2026 through Tucows Domains Inc. and resolves to the Amazon Web Services address 64.29.17.131, which is announced by AS16509 Amazon.com, Inc. in the United States. The site presented the HTTP status code 451 and the page title “Deployment Unavailable,” suggesting that the underlying Vercel deployment has been removed or taken offline. SSL negotiation is performed by a certificate issued by Google Trust Services under the WR1 designation, and the server advertises HTTP Strict Transport Security (HSTS).

VirusTotal scans have recorded 14 detections out of 93 security vendors, and the domain is currently listed on a single security blocklist. Independent threat‑mitigation services such as PhishDestroy have also flagged the host. The combination of a recent registration, AWS hosting, Vercel technology, and a non‑standard 451 response aligns with patterns observed in generic phishing infrastructure that leverages disposable cloud instances.

At present no additional artifacts such as login pages, credential‑harvesting URLs, or malware payloads have been publicly disclosed, leaving the exact phishing campaign details unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any future resolution changes, and consider adding the IP address 64.29.17.131 to reputation‑based deny lists. Ongoing observation of VirusTotal and blocklist updates is recommended to capture any escalation in detection counts or new abuse reports.