# PhishDestroy threat dossier — amazon-harshdeep.vercel.app ================================================================ Fetched: 2026-07-22 10:02:21 UTC Canonical: https://phishdestroy.io/domain/amazon-harshdeep.vercel.app/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Amazon ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 21/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, CyRadar, Ermes, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safe Browsing, Gridinsoft, Kaspersky, LevelBlue, Lionic, MalwareURL, Netcraft, Sophos, VIPRE Public blocklists: listed on 1 independent blocklist Google Safe Browsing: FLAGGED ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 64.29.17.3 (US, Walnut) ASN: AS16509 Amazon.com, Inc. Hosting org: Vercel, Inc Registrar: Vercel Page title: Amazon - Harsh HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WR1 Expires: 2026-09-26 Status: INVALID chain Fingerprint: ee54cb11f16cc311b3acbae57f8fbb03f338c1b2a20de72722c3eafd0dae0140 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-19 12:38:04 UTC (by PhishDestroy tracker) Last verified: 2026-07-22 08:20:23 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-20 01:43:56 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] amazon-harshdeep.vercel.app — Amazon Brand Impersonation Threat This report assesses the domain amazon-harshdeep.vercel.app, which is currently flagged for high-risk brand impersonation targeting Amazon, as evidenced by the page title 'Amazon - Harsh' and the explicit brand targeting in available intelligence. The domain is active as of July 19, 2026, returning HTTP status 200. Analysis shows the domain is hosted by Vercel, Inc. in the US, with IP address 64.29.17.3, and is protected by an SSL certificate from Google Trust Services / WR1. Security telemetry is significant: 21 of 91 VirusTotal vendors have flagged this domain, and Google Safe Browsing lists it for social engineering risk. The domain is also blocked by PhishDestroy and appears on at least one public security blocklist. There is confirmed evidence that the domain is being used for brand impersonation, specifically targeting Amazon, although the exact nature of the phishing content has not been analyzed in detail. The continued active status presents ongoing exposure. Defenders should immediately block access to this domain within their networks and update relevant detection controls. It is recommended to monitor for further related infrastructure or associated domains, as the use of Vercel hosting and a valid SSL certificate could indicate ongoing or future deployments. No evidence of a specific phishing kit or additional malicious artifacts is available from current intelligence. Verification and user notification procedures are advised to mitigate brand impersonation risks. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: c30c7d42707a47a3f4591831641e50dc TLS cert SHA-256: ee54cb11f16cc311b3acbae57f8fbb03f338c1b2a20de72722c3eafd0dae0140 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/amazon-harshdeep.vercel.app/ JSON API: https://api.destroy.tools/v1/check?domain=amazon-harshdeep.vercel.app Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 187,839 domains (57,400 alive under monitoring, 128,795 confirmed takedowns/dead). Site: https://phishdestroy.io