amazon-clone-orcin-ten[.]vercel[.]app

This domain, amazon-clone-orcin-ten.vercel.app, is identified as a high-risk phishing infrastructure specifically designed for brand impersonation targeting Amazon. The site replicates Amazon's visual identity, including an identical page title ('Amazon'), to deceive users into entering credentials or financial information. No direct evidence of a crypto drainer or payment skimmer was observed, but the domain's structure and hosting align with credential harvesting campaigns commonly associated with large-scale retail impersonation schemes. Analysis reveals precise technical indicators confirming malicious intent. The domain is flagged by 21 out of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence platforms. It is registered through Vercel Inc. and resolves to the IP address 216.198.79.3, geolocated within the United States under AS16509 (Amazon.com, Inc.), though this appears to be a routing artifact rather than legitimate hosting. The SSL certificate is issued by Google Trust Services (WR1), a common choice for phishing sites due to its free and automated issuance process. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and remains operational as of the latest verification. Current status confirms the domain is still active, posing an ongoing risk to users. While the infrastructure has been flagged by multiple security platforms, the lack of takedown suggests either delayed enforcement or evasion tactics. Users are advised to avoid interaction with this domain and any subdomains or linked resources. Organizations should update blocklists to include this domain and its associated IP, while monitoring for similar patterns under the Vercel.app namespace. The combination of brand impersonation, active hosting, and low detection-to-blocklist ratio underscores the need for heightened scrutiny of dynamically generated subdomains on content delivery networks.