amazon-tau-ecru[.]vercel[.]app

The domain amazon-tau-ecru.vercel.app was registered on July 13, 2025 through Vercel Inc. and resolves to the IP address 64.29.17.67, which belongs to Amazon.com, Inc. (AS16509) in the United States. The site presented a page title of "Amazon" and is classified as an e‑commerce scam that impersonates the Amazon brand. The HTTPS service is backed by a Google Trust Services / WR1 certificate, a default offering for Vercel‑hosted sites, and HSTS is enforced. DNS queries return no nameserver information, indicating that the authoritative name servers are not publicly disclosed.

An HTTP 451 response was observed, meaning the resource is unavailable for legal reasons; the domain is currently offline and has been taken down by the sinkhole service PhishDestroy. Reputation checks are uniformly negative: Scamadviser assigns a trust score of 1 / 100, Gridinsoft scores 0 / 100, and the site appears on a single security blocklist. Google Safe Browsing flags the domain for social engineering, and VirusTotal reports that 20 of 93 scanned security vendors flagged the domain as malicious. The combination of brand‑targeted page title, e‑commerce scam classification, and the use of legitimate cloud infrastructure to host a fraudulent front‑end raises a high risk rating.

While the site is offline, the infrastructure footprint—specifically the Amazon‑owned IP range and Vercel hosting—could be reused for future impersonation campaigns. Defenders should continue to block the domain at network perimeter controls, monitor the IP address for re‑use, and update detection signatures to include the observed SSL certificate issuer and HTTP 451 response pattern. Awareness campaigns should remind users that any unsolicited Amazon‑related prompts originating from this domain are unauthentic, and organizations should enforce multi‑factor authentication and URL verification for credential entry.