netflix-main-ten[.]vercel[.]app

Analysis of netflix-main-ten.vercel.app indicates a high‑risk brand‑impersonation campaign targeting Netflix. The domain was registered on February 21, 2026 through Tucows Domains Inc. and resolves to the IP address 216.198.79.131, which is owned by Vercel, Inc. in the United States. Infrastructure probes reveal that the site is hosted on Vercel and serves HTTP status 451, a "Unavailable For Legal Reasons" response, while the page title returned is "Deployment Unavailable". The presence of HTTP Strict Transport Security (HSTS) suggests that TLS is enforced, yet the site is currently taken offline.

Reputation services provide converging evidence of malicious intent: Google Safe Browsing flags the domain for social engineering, PhishDestroy has blocked it, and it appears on one security blocklist. VirusTotal reports that 15 of 93 scanning engines flag the domain, reinforcing the suspicion of abuse. The domain explicitly impersonates Netflix, aligning with the brand‑target field.

Uncertainties remain regarding the exact payload or credential‑harvesting mechanisms, as no page content beyond the title has been captured. Defenders should add the domain and its associated IP to deny‑list rules, monitor for any re‑activation, and enforce strict outbound filtering for connections to Vercel‑hosted assets that reference Netflix branding. Continuous re‑scanning with multi‑engine services is advised to capture any changes in the threat posture.