netflixclone-chi-ten[.]vercel[.]app

The domain netflixclone-chi-ten.vercel.app is currently active and classified as a high‑risk generic phishing site. It was registered on 28 January 2020 through Vercel, which serves as both the registrar and the hosting platform. DNS resolution points to the IPv4 address 64.29.17.131, identifying the specific endpoint used for delivery of the malicious content. The domain appears on a single security blocklist and has been blocked by the PhishDestroy service. Google Safe Browsing flags the URL for social engineering, and VirusTotal reports that 20 of 91 scanning engines have identified the domain as malicious, providing concrete vendor consensus of detection.

Infrastructure analysis shows the site relies on Vercel’s cloud infrastructure, a factor that can complicate takedown actions because the provider hosts a large volume of legitimate applications. No public information regarding SSL certificate details, HTTP response codes, page title, or brand‑specific content has been disclosed, so the exact visual spoofing technique and credential‑harvesting mechanisms remain unknown. The lack of additional page metadata limits confirmation of which brand or service is being impersonated beyond the generic phishing classification.

Given the high risk rating and active status, defenders should treat the domain as a confirmed threat. Recommended actions include adding the domain to internal blocklists, ensuring web filtering solutions incorporate Google Safe Browsing and the PhishDestroy feed, and monitoring network traffic for outbound connections to 64.29.17.131. Any authentication attempts that resemble the targeted brand should be closely scrutinized. Because the site is hosted on Vercel, incident response teams may consider contacting the provider’s abuse channel, supplying the detection evidence from VirusTotal and Google Safe Browsing to request removal.