amazonclonezayan[.]netlify[.]app

This domain, amazonclonezayan.netlify.app, is identified as a high-risk brand impersonation threat targeting Amazon. The site is currently offline but was actively impersonating Amazon’s official infrastructure to deceive users into disclosing sensitive credentials or financial information. The page title explicitly stated 'Amazon clone by Zayan,' confirming the intent to mimic the legitimate brand for malicious purposes. Analysis of the domain reveals multiple technical indicators of compromise. The domain was flagged by 17 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was hosted on Netlify’s platform and resolved to the IP address 18.208.88.157, associated with Amazon.com, Inc. (AS14618) in the United States. The SSL certificate, issued by DigiCert Inc under the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' chain, provided a false sense of security while facilitating encrypted communication for phishing activities. The domain appeared on two security blocklists and was explicitly flagged by Google Safe Browsing as phishing. Additional intelligence sources, including PhishDestroy and PhishingDB, confirmed its malicious classification. The domain’s current offline status mitigates immediate risk, but its prior infrastructure and intent warrant continued monitoring. Organizations and users are advised to block the domain and its associated IP address at the network level to prevent potential re-emergence. Security teams should review logs for connections to 18.208.88.157 or references to 'amazonclonezayan.netlify.app' to identify compromised systems. End-users who interacted with the site should reset credentials for Amazon and any other accounts where the same credentials may have been reused. Proactive measures, such as deploying browser-based phishing protections and educating users on identifying brand impersonation tactics, are recommended to reduce future exposure.