amazon-master[.]vercel[.]app

This domain, amazon-master.vercel.app, was registered on 21 February 2026 through Tucows Domains Inc. The authoritative name servers are ns1.vercel-dns-3.com through ns4.vercel-dns-3.com. DNS resolution points to IP address 216.198.79.3, which belongs to ASN 16509 owned by Amazon.com, Inc., and is geolocated in the United States. The site presents an HTTP 200 response and serves an SSL certificate issued by Google Trust Services under the WR1 profile, indicating a valid TLS handshake. The page title returned by the server is “Amazon”, and the brand target is explicitly listed as Amazon, confirming a brand‑impersonation motive. Automated analysis identified a stack that includes Bootstrap, React, jQuery, cdnjs, Stripe, Vercel, and Cloudflare, and the response contains an HSTS header, suggesting intentional use of modern web frameworks to increase credibility.

VirusTotal records show that 23 of 93 security vendors have flagged the domain, and the domain appears on a single external blocklist. PhishDestroy has already added the domain to its block list, reinforcing the detection. Reputation services assign extremely low trust scores—Scamadviser 1 / 100 and Gridinsoft 0 / 100—consistent with an e‑commerce scam classification. The risk rating is high and the campaign status remains active. Current uncertainties include the exact content served to victims, the presence of credential‑collection forms, and any downstream command‑and‑control infrastructure, because no visual analysis of the page has been performed.

Defenders should block both the domain and the underlying IP address, enforce DNS‑level filtering for any sub‑domains under vercel‑dns-3.com, and monitor outbound traffic to the identified IP. Given the use of Stripe libraries, there is a possibility of fraudulent payment page hosting, which further elevates the impact potential. Organizations should also inspect any outbound connections to the Vercel infrastructure for anomalous activity.