amazon-clone-by-izwa[.]netlify[.]app

Analysis conducted on August 02, 2026 identifies amazon-clone-by-izwa.netlify.app as an active phishing domain targeting Amazon users. The domain is hosted on Netlify's infrastructure, a platform frequently abused for rapid deployment of phishing pages due to its free tier and ease of use. At the time of assessment, eight out of ninety-one security vendors on VirusTotal flagged the domain as malicious, indicating moderate but not universal detection. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy, a specialized anti-phishing service.

Infrastructure analysis reveals the domain is a subdomain of netlify.app, a legitimate hosting provider often exploited for phishing due to its SSL support and reputable base domain. No registrar or WHOIS data is available for subdomains on this platform, limiting attribution. The exact content of the phishing page remains unanalyzed, though the domain name explicitly references Amazon, suggesting an intent to deceive users into believing they are interacting with the legitimate Amazon platform. No evidence links this domain to a known phishing kit or campaign at this time.

Defenders should treat this domain as a confirmed phishing threat with elevated risk due to its active status and partial detection by security vendors. Network-level blocking is recommended, particularly for organizations with exposure to retail or e-commerce sectors. Monitoring for additional subdomains under netlify.app or similar hosting platforms may help identify related phishing infrastructure. Further analysis of the page content, if accessible, could clarify the specific tactics used, such as credential harvesting or payment redirection.