n3tflixpk-clone-arwebnox[.]vercel[.]app

Analysis of the domain n3tflixpk-clone-arwebnox.vercel.app indicates it was associated with a credential phishing campaign targeting users of a streaming service, likely Netflix given the domain name construction. The domain was registered on February 21, 2026, through Tucows Domains Inc. and hosted on Vercel infrastructure, resolving to IP 216.198.79.195 within Amazon’s AS16509 (United States). At the time of assessment, the domain returned an HTTP 404 status with the page title '404: NOT_FOUND,' suggesting it had already been taken offline or moved. Infrastructure analysis reveals the use of a Google Trust Services SSL certificate (WR1) and HTTP Strict Transport Security (HSTS), common in phishing sites to appear legitimate.

Detection data from July 23, 2026, shows the domain was flagged by 14 of 93 security vendors on VirusTotal and blocked by at least one security provider, PhishDestroy. The domain appeared on a single security blocklist, reinforcing its classification as malicious. While the exact content of the phishing page is not confirmed due to its offline status, the domain name strongly suggests an intent to deceive users into entering credentials for a Netflix-like service.

Defenders should treat this domain as part of a broader phishing operation and consider blocking it at the network level. Further investigation into related infrastructure, such as other domains hosted on the same IP or registered through the same registrar, may uncover additional threats. Given the elevated risk and confirmed detections, organizations are advised to monitor for any attempts to reuse this domain or its associated infrastructure.