amazon-clone-topaz-two[.]vercel[.]app

This domain, amazon-clone-topaz-two.vercel.app, is flagged for brand impersonation targeting Amazon. Analysis indicates it operates as a cloned storefront designed to harvest user credentials and payment details under the guise of the legitimate Amazon platform. The page title explicitly reads 'Amazon Clone,' confirming its fraudulent intent to deceive visitors into believing they are interacting with the official Amazon website. Technical indicators reveal the domain was registered through Vercel Inc. on March 02, 2026, and resolves to IP address 64.29.17.3, hosted under AS16509 (Amazon.com, Inc.). VirusTotal detection shows 17 out of 95 security vendors have flagged this domain as malicious. The domain appears on one security blocklist and is currently blocked by a threat intelligence feed. The SSL certificate is issued by Google Trust Services (WR1), which may lend an appearance of legitimacy to unsuspecting users. As of the latest verification, the domain remains active and continues to pose a high risk to users. Response actions should include immediate blacklisting in enterprise security controls, DNS sinkholing, and user awareness campaigns to prevent credential theft. The infrastructure analysis reveals the domain leverages Vercel’s hosting services, which are frequently abused for rapid deployment of phishing sites. Organizations should monitor for related IOCs, including the IP 64.29.17.3 and the SSL certificate issuer, to detect potential lateral movement or additional malicious domains.