amazon-clone-virid-two-23[.]vercel[.]app

This domain, amazon-clone-virid-two-23.vercel.app, is an active phishing infrastructure designed to impersonate Amazon, a high-value brand target. Analysis indicates the site employs brand impersonation techniques, presenting an identical page title (Amazon) to deceive users into submitting login credentials, payment details, or other sensitive information. No specific drainer kit signatures were identified in initial scans, but the domain’s structure and behavior align with credential harvesting and fraudulent transaction schemes commonly associated with Amazon-themed phishing campaigns. Technical indicators confirm the domain’s malicious intent. The domain was registered on March 02, 2026, through Vercel Inc., and currently resolves to the IP address 216.198.79.67, hosted on Amazon.com, Inc.’s autonomous system (AS16509). Google Safe Browsing has flagged the domain as phishing, and VirusTotal reports 20 out of 95 security vendors detecting it as malicious. The domain appears on one security blocklist, specifically PhishDestroy, and its SSL certificate is issued by Google Trust Services (WR1). Infrastructure analysis reveals the IP is geolocated in the United States, further linking it to a broader pattern of abuse targeting e-commerce platforms. As of the latest verification, the domain remains active and unresolved by the hosting provider. No takedown requests or sinkholing actions have been observed, leaving the infrastructure operational and capable of targeting additional users. Organizations and individuals are advised to block the domain at the network level, update endpoint protection rules to include the IP address, and monitor for related phishing campaigns leveraging similar Vercel-hosted subdomains. Continuous vigilance is recommended, as the domain’s persistence suggests potential for further exploitation or migration to alternative hosting providers.