amazon-clone-lime-eight[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat targeting Amazon. The site replicates Amazon's branding and page structure to deceive users into disclosing login credentials, payment details, or other sensitive information. Analysis indicates this is not a generic phishing attempt but a targeted impersonation of a major e-commerce platform, increasing the likelihood of successful social engineering attacks against unsuspecting victims. Infrastructure analysis reveals the domain amazon-clone-lime-eight.vercel.app resolves to IP address 216.198.79.3, geolocated in the US under AS16509 (Amazon.com, Inc.). The domain is registered through Vercel Inc. and uses an SSL certificate issued by Google Trust Services (WR1). VirusTotal detection shows 26 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists and is actively blocked by PhishDestroy and PhishingDB. Google Safe Browsing also classifies this domain as phishing. The page title explicitly displays 'Amazon,' further confirming its intent to impersonate the legitimate brand. Mitigation steps specific to brand impersonation threats include immediate blocking of the domain and its resolving IP (216.198.79.3) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) across endpoint detection and response systems, email gateways, and web proxies. Users who may have interacted with the domain should be instructed to reset Amazon credentials and monitor accounts for unauthorized transactions. Organizations should also implement multi-factor authentication (MFA) for all e-commerce and financial accounts to reduce the impact of credential theft. Continuous monitoring for similar domains registered through Vercel or resolving to the same IP range is recommended to identify related threats.