netflix-orcin-six[.]vercel[.]app

This domain is flagged as a high‑risk brand‑impersonation campaign targeting Netflix. The fully qualified name netflix-orcin-six.vercel.app was registered on 21 February 2026 through Tucows Domains Inc. DNS resolution points to the Amazon Web Services address 216.198.79.67, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. An HTTPS endpoint is served using a Google Trust Services certificate (WR1), and the response includes HTTP status 451 with the page title “Deployment Unavailable”. Vercel hosting is identified, and the site enforces HSTS.

Google Safe Browsing classifies the URL as a social‑engineering threat, and PhishDestroy has already taken the site offline. VirusTotal analysis shows that 15 of 95 scanning engines have raised detections, and the domain appears on a single external blocklist. The combination of a recent registration date, AWS infrastructure, a valid Google certificate, and the presence of brand‑impersonation indicators suggests a deliberate attempt to exploit the Netflix brand.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms because the site is currently unavailable and no page content has been captured. Defenders should block the domain at the DNS and proxy level, monitor outbound connections to the associated IP address, and update intrusion‑detection signatures to include the observed SSL fingerprint and HTTP 451 response pattern. Continuous re‑evaluation is recommended in case the actor re‑hosts the campaign on a different Vercel endpoint.