mercado-libre-clone-phi[.]vercel[.]app

This domain, mercado-libre-clone-phi.vercel.app, is flagged as an active credential theft operation impersonating MercadoLibre, a widely recognized e-commerce platform. Analysis indicates the site employs cloned branding, login portals, and payment forms designed to harvest user credentials and financial details. The infrastructure mimics legitimate checkout flows, increasing the likelihood of successful compromise for visitors unaware of the fraudulent nature of the domain. Infrastructure analysis reveals the domain resolves to IP address 216.198.79.3 and is hosted through Vercel, a platform commonly abused for rapid deployment of phishing pages. The SSL certificate is issued by Google Trust Services (WR1), providing a false sense of security to potential victims. As of the latest scan, 18 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The domain appears on one security blocklist, though Google Safe Browsing status remains unconfirmed. No specific creation date is publicly available, but the use of Vercel suggests recent registration to evade detection. The domain remains active, posing a high risk to users who may encounter it through phishing emails, malicious advertisements, or compromised third-party sites. Response actions should include immediate blacklisting in enterprise security tools, DNS filtering, and endpoint protection rules. Users are advised to verify domain authenticity before entering credentials and to enable multi-factor authentication on all financial and e-commerce accounts. Despite partial vendor detection, the domain continues to operate, underscoring the need for continuous monitoring and proactive threat hunting to mitigate credential theft risks.