farhan-netflix-clone[.]vercel[.]app

Analysis of the domain farhan-netflix-clone.vercel.app indicates a high-risk phishing infrastructure targeting Netflix users. The domain was registered on February 21, 2026, through Tucows Domains Inc. and is hosted on IP address 216.198.79.131, associated with Amazon.com, Inc. (AS16509) in the United States. As of July 23, 2026, the domain appears on one security blocklist and is flagged by Google Safe Browsing for social engineering activity. Sixteen of ninety-five security vendors on VirusTotal have detected this domain as malicious, reinforcing its classification as a phishing threat. The domain resolves to a Vercel-hosted page with the title 'Deployment Unavailable,' suggesting the phishing content may have been removed or temporarily disabled.

The HTTP status code 451 ('Unavailable For Legal Reasons') further supports this observation, indicating potential takedown efforts or infrastructure adjustments. The SSL certificate is issued by Google Trust Services (WR1), a common feature in both legitimate and malicious deployments, offering no definitive indication of intent. Infrastructure analysis reveals the use of HTTP Strict Transport Security (HSTS), a security feature that, while typically associated with legitimate services, is occasionally employed by threat actors to lend credibility to phishing pages. The domain explicitly impersonates Netflix, aligning with the observed social engineering classification. Current status confirms the domain is offline, though prior activity and detection metrics warrant continued monitoring.

Defenders should treat this domain as confirmed phishing infrastructure. Network-level blocking is recommended, particularly for organizations in sectors frequently targeted by credential harvesting campaigns. Security teams should review logs for connections to 216.198.79.131 or the domain itself, as these may indicate prior compromise or ongoing reconnaissance.