amazon-clone-six-rho[.]vercel[.]app

This domain, amazon-clone-six-rho.vercel.app, is flagged as an active brand impersonation threat targeting Amazon. The site replicates Amazon’s interface and page title, attempting to deceive users into entering credentials or financial details. No crypto drainer kit signatures were observed, but the infrastructure aligns with credential harvesting campaigns. The domain’s design and metadata closely mirror the legitimate Amazon platform, increasing its effectiveness in social engineering attacks. Analysis indicates the following technical indicators: the domain is detected by 20 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging it as phishing. It was registered through Tucows Domains Inc. and resolves to the IP address 216.198.79.195, hosted on Amazon.com, Inc.’s AS16509 network in the United States. The domain was created on February 21, 2026, and is currently associated with a Google Trust Services SSL certificate (WR1). It appears on two security blocklists and is blocked by at least two threat intelligence feeds. As of the latest verification, the domain remains active and unresolved by the registrar or hosting provider. Users are advised to treat any interaction with this domain as malicious. Organizations should update blocklists to include this domain and its resolving IP, while individuals should avoid entering credentials or personal information. The remaining risk is classified as high due to the domain’s operational status and its presence on multiple threat intelligence platforms.