emansamazonclone[.]netlify[.]app

This domain, emansamazonclone.netlify.app, is currently flagged as an active credential phishing site impersonating Amazon. The page title explicitly identifies itself as an 'Amazon clone,' indicating a deliberate attempt to deceive users into submitting login credentials or payment details. The domain remains operational and has not been taken down despite multiple security detections, posing a high risk to end users who may mistake it for legitimate Amazon services.

Analysis indicates the domain was registered through Netlify on April 2, 2026, and resolves to the IP address 63.176.8.218, hosted on infrastructure located in Germany (AWS EC2, eu-central-1 region). The SSL certificate is issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, which, while valid, does not mitigate the malicious intent of the site. Security vendors on VirusTotal have flagged this domain as malicious, with 21 out of 95 engines detecting it as phishing. Additionally, the domain appears on one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. The infrastructure analysis reveals the use of a content delivery network, which may complicate takedown efforts and prolong the domain's availability.

As of the latest assessment, emansamazonclone.netlify.app remains active and continues to present a significant threat to users. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to prevent interaction. Users who may have visited the site should immediately reset their Amazon credentials and monitor accounts for unauthorized activity. Security teams are encouraged to treat this domain as a high-priority indicator of compromise and include it in threat intelligence feeds for broader awareness.