amazon-clone-sable-rho[.]vercel[.]app

The domain amazon-clone-sable-rho.vercel.app is actively flagged as a high‑risk generic phishing site. Infrastructure analysis shows the domain is registered through Vercel Inc., a cloud‑hosting provider that supplies the underlying Vercel.app platform. DNS resolution points to the IP address 64.29.17.131, and no authoritative nameservers were returned in the query, indicating that standard DNS records are absent or concealed. VirusTotal has recorded detections from 19 of 91 security vendors, providing a moderate consensus of malicious behavior across multiple scanning engines.

Independent blocklist monitoring confirms the domain is listed on at least one public security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the assessment of hostile intent. Google Safe Browsing classifies the site under the “social engineering” category, which aligns with typical credential‑harvesting tactics. The combination of vendor detections, blocklist inclusion, and Safe Browsing flag demonstrates that the domain is being used to lure users into divulging login credentials or other sensitive data.

No additional evidence such as page titles, SSL certificates, HTTP response codes, or content analysis is currently available, leaving the exact phishing vector (e.g., credential‑capture form, malicious download) uncertain. Defenders should immediately add the domain to network and endpoint deny lists, enforce DNS‑level blocking, and monitor outbound connections to the associated IP address. Security teams should also update web‑filtering policies to block any URLs under the vercel.app sub‑domain that resolve to this IP, and consider broader threat‑intel sharing with peers to capture any emerging indicators of compromise linked to this infrastructure.