amcl[.]vercel[.]app

This domain, amcl.vercel.app, is identified as a generic phishing site specifically designed to impersonate Amazon. Analysis indicates the page title explicitly displays 'Amazon,' suggesting an intent to deceive users into believing they are interacting with the legitimate e-commerce platform. While no specific drainer kit signatures were detected in initial scans, the domain exhibits characteristics consistent with credential harvesting and payment fraud schemes commonly deployed against retail brands. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 64.29.17.3, hosted under AS16509 (Amazon.com, Inc.), though not affiliated with the legitimate Amazon infrastructure. The domain is registered through Vercel Inc., a platform frequently abused for rapid phishing deployment. VirusTotal detections show 21 out of 95 security vendors flagging the domain as malicious. Google Safe Browsing classifies the site as phishing, and it appears on two independent security blocklists. The SSL certificate is issued by Google Trust Services (WR1), a common certificate authority for both legitimate and malicious sites, providing no inherent trust validation. As of the latest verification, amcl.vercel.app has been taken offline, likely following abuse reports or automated takedown procedures. However, residual risk remains for users who may have interacted with the domain prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized account access, review recent transaction logs, and implement multi-factor authentication where available. Network defenders should update blocklists to include this domain and its associated IP address, while remaining vigilant for similar phishing attempts leveraging cloud hosting platforms for rapid deployment and evasion.