roaring-wisp-bf1c61[.]netlify[.]app

This domain, roaring-wisp-bf1c61.netlify.app, is flagged as an active phishing site impersonating the Amazon brand. Analysis of the page title, 'Amazon Clone,' confirms the site is designed to mimic the legitimate Amazon platform, likely targeting user credentials or financial information through a fake login portal. No direct evidence of a crypto drainer kit is present, but the infrastructure aligns with credential harvesting tactics commonly used in brand impersonation schemes. Infrastructure analysis reveals the following technical indicators: the domain is registered through Netlify and resolves to the IPv6 address 2a05:d014:58f:6200::259, hosted under AS16509 (Amazon.com, Inc.) in Germany. The SSL certificate is issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1). The domain is detected by 17 out of 95 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. No Google Safe Browsing (GSB) record is currently available for this domain, but the active status and detection rate indicate a high-risk classification. As of the latest assessment, the phishing site remains active, posing an ongoing threat to users. Immediate response actions include blacklisting the domain across security platforms and notifying the hosting provider (Netlify) for takedown. Despite these measures, the remaining risk persists due to the site's operational status and the potential for rapid redeployment under a new domain. Users are advised to avoid interaction with the domain, verify URLs before entering credentials, and report any suspicious activity to their security teams. Organizations should update their blocklists to include this domain and monitor for related infrastructure.