netflix-clone-hohf[.]vercel[.]app

The domain netflix-clone-hohf.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. and is hosted on Vercel infrastructure, as indicated by the Vercel technology fingerprint and the presence of HTTP Strict Transport Security (HSTS). DNS resolution points to the IP address 64.29.17.67, which belongs to Amazon.com, Inc. (AS16509) in the United States. The site presents a TLS certificate issued by Google Trust Services under the WR1 intermediate, confirming that transport encryption is correctly configured despite the domain’s malicious purpose.

An HTTP request to the host returns status code 451, and the page title returned is "Deployment Unavailable," suggesting that the content has been taken down or is otherwise inaccessible at the time of analysis. Google Safe Browsing has flagged the domain for social engineering, and PhishDestroy lists it on a dedicated blocklist, confirming that security vendors have identified the site as a brand‑impersonation threat targeting Netflix. VirusTotal reports that 16 of 93 scanning engines flag the domain as malicious, providing additional independent confirmation of its abusive nature.

The overall risk rating is high, and the current operational status is offline, meaning no active payload is observable, but the infrastructure remains in place for potential re‑use. Defenders should continue to block the domain at network perimeter controls, add the IP address 64.29.17.67 to reputation‑based deny lists, and monitor for any new subdomains or redeployments under the same Vercel account. Ongoing surveillance of the hosting provider and the ASN is advised, as the same infrastructure could be leveraged for future impersonation campaigns.