amazonbylio[.]vercel[.]app

This domain operates as a credential phishing site designed to harvest Amazon login credentials from unsuspecting users. The site presents a fraudulent Amazon login interface under the title 'Amazon Clone by Lio,' tricking visitors into entering sensitive account information. Analysis indicates the infrastructure is specifically crafted to mimic legitimate Amazon authentication pages, increasing the likelihood of successful deception. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was created on January 28, 2020, and is registered through Vercel Inc., resolving to IP address 216.198.79.3 within Amazon.com's AS16509 network. Security vendors have flagged the domain with 23 detections out of 95 on VirusTotal, while Google Safe Browsing and two security blocklists (PhishDestroy and PhishingDB) classify it as phishing. The presence of a Google Trust Services SSL certificate further enhances the site's deceptive appearance of legitimacy. Users who visited amazonbylio.vercel.app should immediately change their Amazon password and enable multi-factor authentication on their account. Any credentials entered on this site should be considered compromised, necessitating password updates for other services where identical login details may have been reused. Monitor financial accounts and credit reports for unauthorized activity, as stolen credentials can lead to fraudulent transactions. Report the incident to Amazon's security team and consider notifying local cybercrime authorities to assist in tracking this phishing operation.