netflix-clone-mu-seven[.]vercel[.]app

The domain netflix-clone-mu-seven.vercel.app was registered on March 08, 2026 through Vercel Inc. and resolves to the Amazon‑owned IP address 216.198.79.3 (AS16509, United States). The site presented a TLS certificate issued by Google Trust Services under the WR1 name, indicating a valid HTTPS endpoint despite the malicious intent. HTTP responses returned a 451 status, signalling that the resource is unavailable for legal reasons, which aligns with the current offline state reported by defenders. Google Safe Browsing has flagged the domain for social engineering, and the site appears on one external security blocklist.

Independent threat‑intelligence feeds, including PhishDestroy, have already blocked the domain, confirming active mitigation. VirusTotal analysis shows that 23 of 94 scanning engines label the host as malicious, and the Gridinsoft trust score of 0 / 100 reinforces the high‑risk assessment. Scamadviser assigns a trust score of 1 / 100, reflecting the negligible reputation of the domain. The page title returned "Netflix," yet the known intelligence categorises the operation as a tech‑support scam that impersonates Apple, indicating a deliberate brand‑mixing tactic to lure victims.

While the exact payload or victim interaction flow has not been publicly disclosed, the convergence of multiple detection sources, low trust metrics, and the presence of a legitimate‑looking certificate suggest a sophisticated social‑engineering campaign. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration attempts, and update incident response playbooks to include Apple‑related tech‑support lure scenarios. Further analysis of any captured traffic or payloads would be required to detail the specific ransomware or credential‑harvesting mechanisms employed.