amazon-clone001[.]vercel[.]app

This domain, amazon-clone001.vercel.app, is actively engaged in brand impersonation targeting Amazon, designed to facilitate credential theft. The page title explicitly reads "Amazon Clone," and the infrastructure mimics legitimate Amazon branding to deceive users into submitting sensitive login or payment details. No crypto drainer kit signatures were observed, but the site employs standard phishing tactics to harvest credentials, likely for resale or account takeover purposes.

Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered through Tucows Domains Inc. on February 21, 2026, an unusually future-dated creation that may indicate registry manipulation or a placeholder. It resolves to IP address 64.29.17.3, hosted under AS16509 (Amazon.com, Inc.), suggesting potential abuse of cloud infrastructure. Google Safe Browsing has flagged the domain as phishing, and it appears on at least one security blocklist. VirusTotal detection rates stand at 22 out of 95 security vendors, with detections from major engines confirming malicious intent. The SSL certificate, issued by Google Trust Services (WR1), provides a false sense of security while encrypting exfiltrated data.

As of the latest assessment, the domain remains active and unmitigated, posing a continued risk to users. While some security providers (e.g., PhishDestroy) have blocked access, the site is still reachable through unprotected networks or outdated security controls. Immediate response actions should include domain suspension via the registrar, IP-based blocking at the network level, and public disclosure of the threat to prevent further victimization. The remaining risk is classified as high due to the domain's operational status, credible detection rates, and direct targeting of a major e-commerce brand. Organizations are advised to update endpoint protection rules, enforce strict certificate validation, and monitor for credential reuse stemming from this campaign.