amazon-clone-lemon-eta[.]vercel[.]app

Analysis of the domain amazon-clone-lemon-eta.vercel.app indicates an active high-risk brand impersonation campaign targeting Google, despite the page title displaying 'Amazon Clone.' The domain was registered on April 15, 2026, through Vercel Inc. and currently resolves to the IP address 216.198.79.3, associated with a hosting provider in the United States. Infrastructure analysis reveals the absence of configured nameservers, while the SSL certificate is issued by Google Trust Services, a detail that may contribute to the site's superficial legitimacy. Detection metrics from security vendors reflect moderate concern: 19 of 94 engines on VirusTotal flag the domain as malicious, and it appears on one security blocklist. The domain is also explicitly blocked by a phishing detection service, reinforcing its classification as a brand impersonation threat. Google Safe Browsing has categorized this domain under 'SOCIAL_ENGINEERING,' further confirming its deceptive nature. Additional trust indicators, including a Gridinsoft score of 0/100 and a Scamadviser score of 1/100, align with the assessment of high risk. The discrepancy between the domain's naming convention (suggesting an Amazon impersonation) and its confirmed targeting of Google underscores the need for caution in attributing brand-specific threats based solely on domain structure. Technologies detected on the domain include Vercel hosting and HTTP Strict Transport Security (HSTS), which may be leveraged to enhance the site's perceived authenticity. As of July 12, 2026, the domain remains active and returns an HTTP 200 status, indicating operational status. Defenders should prioritize blocking this domain at the network level and monitor for related infrastructure, particularly subdomains or IPs associated with 216.198.79.3. Further investigation into the hosting provider's abuse policies may aid in mitigation efforts.