amazoneclonevaibhavd[.]netlify[.]app

This domain, amazoneclonevaibhavd.netlify.app, is actively engaged in phishing operations targeting users of the Amazon e-commerce platform. Analysis confirms the site as a high-risk generic phishing threat, currently operational and designed to harvest credentials or financial information under the guise of legitimate Amazon services. The page title explicitly mimics Amazon, reinforcing the impersonation attempt. Infrastructure analysis reveals the domain was registered through Netlify on April 17, 2026, an anomalous creation date suggesting potential manipulation of registration records. It resolves to the IP address 63.176.8.218, hosted on infrastructure located in Germany (AWS EC2 eu-central-1 region). The domain is flagged by 6 of 95 security vendors on VirusTotal, appears on one security blocklist, and is actively blocked by at least one threat intelligence feed. The SSL certificate is issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, a common certificate authority that does not inherently validate legitimacy. The domain remains active as of this report, posing an ongoing risk to users who may encounter it through phishing campaigns. Organizations and individuals are advised to block the domain and its associated IP address at the network perimeter. Endpoint protection systems should be updated to include this indicator of compromise. Users should be educated to verify domain authenticity before entering credentials, particularly when redirected from unsolicited communications. Monitoring for related domains registered through Netlify or resolving to the same IP range is recommended for proactive threat detection.