amazon-clone-blue-ten[.]vercel[.]app

This domain, amazon-clone-blue-ten.vercel.app, is an active credential harvesting site designed to impersonate Amazon’s official login portal. Analysis indicates the site presents a near-identical interface to Amazon’s legitimate authentication page, likely aiming to deceive users into submitting their account credentials, payment details, or personal information. The page title explicitly displays 'Amazon,' reinforcing the deception by mimicking the brand’s visual and structural elements. Such impersonation attacks are commonly used to facilitate account takeovers, unauthorized transactions, or identity theft. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered through Vercel Inc. on March 07, 2026, and currently resolves to the IP address 64.29.17.3, associated with Amazon.com, Inc. (AS16509). Security vendors have flagged the domain as malicious, with 28 out of 95 engines on VirusTotal detecting it as a phishing threat. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, and uses an SSL certificate issued by Google Trust Services (WR1), which does not validate legitimacy. The combination of brand impersonation, recent registration, and blocklist presence elevates the risk profile. Users who have visited amazon-clone-blue-ten.vercel.app or entered credentials on the site should take immediate action to mitigate potential compromise. First, reset passwords for Amazon and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor financial statements and account activity for signs of fraudulent transactions. If payment details were submitted, contact the relevant financial institution to report potential exposure and request card replacement. Finally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads or redirect to exploit kits.