amazon-frontend-n1s9[.]vercel[.]app

This domain poses a high risk as a confirmed brand impersonation threat, specifically targeting Amazon customers. The site is actively attempting to harvest login credentials by mimicking Amazon's official login page, as evidenced by its page title "Amazon" and the domain's deceptive naming convention. PhishDestroy has assessed this threat as critical due to its active status and the widespread trust in the Amazon brand.

Technical analysis reveals alarming indicators: VirusTotal flags it with 21 out of 95 security vendors detecting malicious activity, and it appears on 2 security blocklists. Google Safe Browsing categorizes it as phishing. The domain was registered through Vercel Inc. and resolves to IP address 64.29.17.3, with an SSL certificate issued by Google Trust Services / WR1. Despite these red flags, the site remains active, underscoring the urgency of the threat.

Users who encounter this domain should immediately close any open pages and avoid entering any personal information. If credentials were already submitted, the affected accounts should be secured by changing passwords and enabling multi-factor authentication. Reporting the domain to Amazon and relevant security authorities is strongly recommended to help disrupt this phishing operation. Regular monitoring of financial accounts for unauthorized activity is also advised.