ecommerce-clone-ashy[.]vercel[.]app

ecommerce-clone-ashy.vercel.app is an active domain created on 14 Nov 2025 and hosted on Vercel’s platform. The site presents the page title “E‑Commerce Clone” and is explicitly associated with a brand‑impersonation campaign targeting Amazon. The domain resolves to 216.198.79.67, an address announced by AS16509, which is owned by Amazon.com, Inc., indicating that the infrastructure is provisioned on Amazon’s cloud network.

The HTTPS endpoint is protected by a certificate issued by Google Trust Services under the WR1 label, and the server enforces HTTP Strict Transport Security. These TLS artifacts are typical for legitimate services, yet they do not mitigate the malicious intent of the site. Vercel’s technology stack is detected, confirming that the attacker leveraged a publicly available hosting service to accelerate deployment.

Independent reputation engines flag the domain as high‑risk. VirusTotal reports that 23 of 95 scanned security vendors have raised alerts, and Google Safe Browsing classifies the URL under the “SOCIAL_ENGINEERING” category. Gridinsoft assigns a trust score of 0 / 100, and the domain is listed on two public blocklists, including PhishDestroy and PhishingDB. The convergence of these signals reinforces a high confidence assessment of brand‑impersonation activity.

Defenders should treat any traffic to ecommerce-clone-ashy.vercel.app as malicious. Immediate actions include adding the domain to DNS‑based blocklists, configuring web proxies to deny HTTP/HTTPS requests, and monitoring for credential or payment‑related disclosures that may be exfiltrated through the site. Continuous threat‑intel feeds should be consulted for any future infrastructure changes, and affected users should be advised to verify Amazon communications through official channels.