amazon-my-kx5t[.]vercel[.]app

Infrastructure analysis reveals that the domain amazon-my-kx5t.vercel.app was actively impersonating Amazon as part of an e-commerce scam. The domain, created on February 21, 2026, was hosted on Vercel and resolved to IP address 216.198.79.67, which geolocates to the United States under Amazon.com, Inc.'s AS16509. At the time of assessment, the domain returned an HTTP 451 status and displayed a page titled 'Deployment Unavailable,' suggesting either a takedown or temporary suspension of the phishing page. Security vendor detections were recorded, with 15 of 95 engines on VirusTotal flagging the domain as malicious.

The domain also appeared on one security blocklist and was blocked by PhishDestroy. SSL certification was issued by Google Trust Services (WR1), a common feature in both legitimate and malicious infrastructure. The registrar of record was Tucows Domains Inc., though no abuse contact or enforcement action was documented in the available data. While the domain is now offline, its prior use in brand impersonation and the presence of HSTS headers indicate an attempt to lend credibility to the scam.

Defenders should treat any prior connections to this domain as indicative of credential theft or fraudulent transaction attempts. Historical DNS and proxy logs should be reviewed for interactions with 216.198.79.67 or the Vercel hosting environment. No additional scam mechanics, such as payment redirection or fake login flows, were confirmed in the available data, and the exact content of the phishing page remains unanalyzed.