amazon-clone-theta-six[.]vercel[.]app

This domain, amazon-clone-theta-six.vercel.app, operates as a confirmed brand impersonation site designed to deceive users into disclosing sensitive credentials by mimicking the legitimate Amazon platform. Analysis indicates the site employs visual and structural elements identical to Amazon's official interface, including identical page titles and branding, to facilitate credential theft. The threat specifically targets users seeking Amazon services, presenting a high-risk scenario for account compromise and subsequent unauthorized access to personal and financial data. Infrastructure analysis reveals the domain was registered through Vercel Inc. on March 02, 2026, and currently resolves to the IP address 216.198.79.67, hosted within AS16509 (Amazon.com, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WR1), a common feature in both legitimate and malicious sites. Detection metrics show 20 out of 95 security vendors on VirusTotal have flagged this domain as malicious, while it appears on one security blocklist. The domain remains active as of the latest verification, indicating ongoing operational status. Users who have visited amazon-clone-theta-six.vercel.app should immediately cease all interaction and perform a comprehensive security review. This includes changing passwords for Amazon and any other accounts where identical credentials may have been reused, enabling multi-factor authentication where available, and scanning affected devices for malware. Financial institutions should be notified if payment details were entered. Organizations are advised to block the domain and associated IP address (216.198.79.67) at the network perimeter to prevent further exposure. Monitoring for unauthorized transactions or account activity is strongly recommended for the next 30 days.