amazon-clone-mocha-nine[.]vercel[.]app

This domain, amazon-clone-mocha-nine.vercel.app, poses a direct threat as a brand impersonation phishing site targeting Amazon customers. The site mimics Amazon’s branding, including a nearly identical page title (Amozon) and visual design, to deceive visitors into entering login credentials, payment details, or other sensitive information. Such phishing domains are commonly used to harvest user data for fraud, account takeovers, or unauthorized transactions. The misspelled page title (Amozon) is a deliberate tactic to evade detection while appearing legitimate to unsuspecting users. Analysis indicates this domain was created on January 28, 2020, and is registered through Vercel Inc. infrastructure. It is flagged by 19 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly marking it as phishing. The domain appears on at least one security blocklist and is currently active, resolving to an IP address (64.29.17.67) associated with Amazon.com, Inc. (AS16509). The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as phishing sites frequently use valid certificates to appear trustworthy. If a user has visited this domain or entered any information, immediate action is required. First, change passwords for any accounts accessed from the site, prioritizing Amazon and linked email accounts. Enable multi-factor authentication where available. Monitor financial statements for unauthorized transactions and report any suspicious activity to the relevant institution. Scan the device used to access the site for malware, as phishing pages may deploy malicious payloads. Users should also report the domain to their security software provider and consider notifying the brand being impersonated (Amazon) to aid in takedown efforts.