amazon-frontend-wheat[.]vercel[.]app

This domain, amazon-frontend-wheat.vercel.app, is actively impersonating Amazon as part of a credential phishing campaign. Registered on April 30, 2026, through Vercel Inc., it resolves to 216.198.79.3 (US-based hosting, Lefkoff Industries) and presents a page titled 'Amazon Clone.' The domain is flagged by Google Safe Browsing for social engineering and appears on at least one security blocklist. Infrastructure analysis reveals Vercel hosting with Stripe integration and HSTS enforcement, suggesting an attempt to appear legitimate. The SSL certificate is issued by Google Trust Services (WR1), and the domain lacks configured nameservers, which may indicate ephemeral or disposable infrastructure. While 20 of 91 security vendors on VirusTotal detect this domain as malicious, the exact phishing kit or payload remains unconfirmed. Defenders should prioritize blocking this domain at DNS and web proxy layers, particularly in environments where Amazon credentials are critical. Monitor for related subdomains or IP reuse, as the hosting provider and infrastructure patterns may be reused for future campaigns. No evidence currently links this domain to broader threat actor infrastructure, but its active status and brand impersonation warrant immediate mitigation.