netflix-clone-app-gules-beta[.]vercel[.]app

Analysis of netflix-clone-app-gules-beta.vercel.app indicates a confirmed brand impersonation campaign targeting Netflix users, classified as elevated risk. The domain was registered on February 21, 2026, through Tucows Domains Inc. and resolved to IP 216.198.79.131, hosted on Amazon.com, Inc. infrastructure (AS16509) located in the US. At the time of assessment, the domain returned an HTTP 451 status with a page title of 'Deployment Unavailable,' suggesting it was either taken down or misconfigured. The SSL certificate was issued by Google Trust Services (WR1), and HSTS was enforced, though these do not mitigate the malicious intent.

Thirteen of ninety-five security vendors on VirusTotal flagged this domain as malicious, aligning with its appearance on one security blocklist. The domain was blocked by PhishDestroy, further corroborating its classification as a phishing site. Infrastructure analysis reveals the use of Vercel hosting, a common platform for deploying cloned or fraudulent applications. While the exact content of the site remains unanalyzed due to its offline status, the domain name, brand target (Netflix), and detection metrics confirm its role in brand impersonation.

Defenders should treat this domain as compromised and maintain blocking rules. Given its association with Netflix impersonation, monitoring for similar Vercel-hosted domains with comparable naming patterns (e.g., 'netflix-clone', 'app-beta') is recommended. The domain’s current offline status limits further forensic analysis, but historical DNS and WHOIS records should be preserved for potential incident response. No evidence suggests persistence beyond the reported takedown, though vigilance for re-registration or migration to alternative hosting is advised.