amazon-clone-mocha-three[.]vercel[.]app

The domain amazon-clone-mocha-three.vercel.app was observed on July 12, 2026 and classified as a high‑risk brand‑impersonation campaign targeting the Amazon brand. The site returns HTTP 200 and presents a page title of “Amazon”, directly mimicking the legitimate retailer’s login and checkout interfaces. The threat actor appears to be leveraging a recent registration (created March 02 2026) to host a counterfeit e‑commerce front that solicits credentials and payment information.

Infrastructure analysis shows the domain resolves to the IP address 64.29.17.195, which belongs to the Amazon.com, Inc. network (AS16509) and is hosted on the Vercel platform. The site is protected by an SSL certificate issued by Google Trust Services under the WR1 identifier, and HTTP Strict Transport Security (HSTS) is enabled. The combination of a reputable hosting provider and a valid certificate may increase user trust, while the underlying IP resides in the United States.

Multiple security engines have flagged the domain; VirusTotal reports 17 detections out of 95 scanners, indicating a substantial malicious consensus. Reputation services assign a trust score of 1/100 (Scamadviser) and 0/100 (Gridinsoft), and the domain is listed on at least one active blocklist, including PhishDestroy. The page content and HTTP status (200) suggest the site is fully operational and actively serving phishing pages.

Defenders should add the domain to network and email filtering rules, enforce DNS sink‑hole or blocklist policies, and monitor for similar sub‑domains created on the same Vercel account. Incident responders should treat any credentials or payment data submitted to this site as compromised, initiate credential rotation for affected users, and educate end‑users about the visual similarity of the page title and URL structure.