amazon-clone-swart-kappa[.]vercel[.]app

PhishDestroy identifies amazon-clone-swart-kappa.vercel.app as an active phishing domain engineered to impersonate Amazon’s login interface, likely deployed to harvest credentials and drain cryptocurrency wallets. This domain resolves to IP address 64.29.17.3 and is currently accessible via a Vercel subdomain, suggesting rapid deployment via a legitimate cloud provider. The threat is elevated due to its use of a Google Trust Services SSL certificate, which may lull victims into a false sense of security by displaying a padlock icon in browsers.

This domain has been flagged by 19 out of 95 security vendors on VirusTotal, placing it in the top quartile of detected malicious domains. It is registered through Vercel Inc., a platform often abused for disposable phishing infrastructure due to its fast provisioning and free tier. Additionally, the domain is listed on one public blocklist, indicating prior detection by threat intelligence systems. While the domain is relatively young, its integration into known phishing campaigns—particularly those targeting Amazon users—highlights a coordinated effort to compromise login credentials and associated financial data.

Users who have visited this domain should immediately check their devices for unauthorized browser extensions, review wallet transaction histories, and change passwords used on Amazon or other e-commerce platforms. Enable two-factor authentication where available and run a full antivirus scan. If credentials were entered, revoke active sessions on Amazon and monitor linked payment methods for unauthorized transactions. For further verification, use PhishDestroy’s real-time URL checker to confirm the legitimacy of any Amazon login page before entering sensitive information.