amazon-clone-blue-nu[.]vercel[.]app

The domain amazon-clone-blue-nu.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. and resolves to IP address 216.198.79.3, which is allocated to Amazon.com, Inc. (AS16509) in the United States. The site returns HTTP 200 and presents a page title of "Amazon," confirming the intent to mimic the legitimate retailer. SSL is provided by Google Trust Services under the WR1 certificate, and the hosting stack includes Vercel with HTTP Strict Transport Security enabled, a common configuration for fast‑deployment sites. Threat intelligence flags the domain as an E‑Commerce scam that impersonates the Amazon brand.

Detection coverage is substantial: 22 of 93 VirusTotal scanners have raised alerts, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on at least one external blocklist. It has already been blocked by the PhishDestroy service. The current operational status is active, indicating that the malicious infrastructure remains reachable.

While the page content has not been publicly dissected, the combination of brand‑specific page title, verified SSL, and hosting on a reputable cloud platform suggests a credential‑harvesting or fraudulent purchase flow typical of brand‑impersonation campaigns. Defenders should add the domain and its associated IP to local deny lists, enforce URL filtering for any Vercel‑hosted subdomains that resolve to the same IP, and monitor for similar naming patterns that include "amazon" and "clone". Continuous re‑scanning with multi‑vendor services is advised to capture any evolution of payloads or additional indicators of compromise.