coin-baseclone[.]vercel[.]app

This domain, coin-baseclone.vercel.app, operates as a fraudulent Amazon storefront designed to harvest user credentials and payment details through brand impersonation. Analysis indicates the site mimics legitimate Amazon login and checkout pages, presenting a high-risk threat to visitors who may unknowingly submit sensitive information to attackers. The infrastructure is optimized for social engineering, leveraging Amazon’s visual branding and domain reputation to deceive targets. Evidence confirms the domain was registered on February 21, 2026, through Tucows Domains Inc., and currently resolves to IP address 64.29.17.67, hosted on Amazon.com, Inc. infrastructure (AS16509). Security vendors on VirusTotal flag the domain as malicious, with 14 out of 95 detections, while one security blocklist (PhishDestroy) has already listed it. The SSL certificate, issued by Google Trust Services (WR1), provides a false sense of security, as the underlying content remains malicious. The page title, 'React App,' further suggests the use of a generic frontend framework to rapidly deploy phishing templates. Users who visited coin-baseclone.vercel.app should immediately revoke any entered credentials, particularly Amazon login details, and monitor financial accounts for unauthorized transactions. If payment information was submitted, affected parties should contact their financial institution to dispute fraudulent charges and request card reissuance. System scans using updated security tools are recommended to detect potential malware or backdoors installed during the interaction. Organizations should block the domain and associated IP (64.29.17.67) at the network level to prevent further exposure.