amazon-clone-amber-six[.]vercel[.]app

The domain amazon-clone-amber-six.vercel.app has been identified as a high-risk phishing threat, specifically engaging in brand impersonation of Amazon. This domain was created on April 04, 2026, and is actively hosting a fraudulent Amazon clone page designed to steal user credentials. The page title explicitly reads 'Amazon Clone,' confirming the impersonation attempt. No specific drainer kit has been associated with this domain, but the phishing infrastructure is fully operational.

Technical indicators paint a clear picture of malicious intent. VirusTotal analysis shows that 19 out of 95 security vendors flag this domain as malicious, giving it a high confidence score. Google Safe Browsing also flags it for phishing, adding to the credibility of the threat. The domain resolves to IP address 64.29.17.131 and is registered through Vercel Inc., with an SSL certificate issued by Google Trust Services / WR1. The domain appears on one security blocklist, indicating limited but existing awareness among threat intelligence platforms.

Currently, the domain remains active and accessible, posing an ongoing risk to users who may be lured into entering their Amazon credentials. PhishDestroy recommends immediate blocking of this domain at the network level and reporting it to Google Safe Browsing and Vercel Inc. for takedown. Users who have visited the site should change their Amazon passwords and enable two-factor authentication. The remaining risk is high due to the active status and the realistic appearance of the clone page, which could easily deceive unsuspecting victims.