clone-six-iota[.]vercel[.]app

Analysis of clone-six-iota.vercel.app, observed on July 23, 2026, indicates that the domain is being used for brand impersonation targeting Amazon. The site presented a page title of “clone” and was classified as an e‑commerce scam. The domain resolves to IP address 216.198.79.131, which belongs to AS16509 Amazon.com, Inc., located in the United States. Registration data show the domain was created on January 28, 2020 and is registered through Vercel Inc., with authoritative nameservers ns1.vercel-dns-3.com, ns2.vercel-dns-3.com, ns3.vercel-dns-3.com, and ns4.vercel-dns-3.com. Technical fingerprinting identified the use of Vercel hosting and HTTP Strict Transport Security (HSTS). The TLS certificate is issued by Google Trust Services under the WR1 subject, confirming the presence of a valid SSL layer despite malicious intent.

Security telemetry reports that the domain was blocked by PhishDestroy and appears on a single security blocklist. VirusTotal analysis recorded 16 detections out of 93 scanned vendors, indicating moderate consensus among scanners. The site returned HTTP status code 451, suggesting a legal restriction or unavailable content at the time of testing. Scamadviser assigned a trust score of 1 out of 100, reflecting extreme risk. The current operational status is offline, which limits immediate interaction but does not mitigate the historical threat.

Uncertainty remains regarding the precise content served prior to takedown, as the page title alone provides limited insight into the user‑facing experience. No additional indicators such as phishing kits, redirects, or credential‑harvesting scripts have been disclosed. Defensive recommendations include adding the domain and its resolved IP address to deny‑list rules across perimeter firewalls, DNS filtering services, and endpoint protection platforms. Organizations should also monitor for similar sub‑domains under the vercel.app namespace that may reuse the same Vercel infrastructure.