netflix-6ewu47an3-mario-oliver[.]vercel[.]app

Analysis of netflix-6ewu47an3-mario-oliver.vercel.app shows a high‑risk brand impersonation campaign targeting Netflix. The domain was registered on February 21, 2026 through Tucows Domains Inc. and resolves to IP address 216.198.79.195, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The hosting environment reports Vercel technology and HSTS enforcement, while the TLS certificate is issued by Google Trust Services under the WR1 identifier, indicating a valid HTTPS configuration.

Google Safe Browsing classifies the site as social engineering, and fifteen of ninety‑three VirusTotal scanners flagged it, confirming malicious intent. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed. An HTTP request returns a 404 status with the page title "404: NOT_FOUND," and the current operational status is offline.

While the exact payload, credential‑harvesting pages, or phishing lures have not been captured, the combination of brand targeting, registrar data, hosting details, and multiple vendor detections provides sufficient evidence for defensive action. Defenders should add the domain to URL filtering and DNS sinkhole lists, monitor the associated IP range for related activity, and consider broader blocks of Vercel‑hosted subdomains that exhibit similar registration patterns. Continuous re‑evaluation is advised, as the offline status may change and additional indicators could emerge from future scans.