linkedin-clone-green[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat specifically targeting LinkedIn users. Analysis indicates the site mimics LinkedIn’s official branding, including the page title 'LinkedIn,' to deceive victims into disclosing credentials or sensitive information. The threat type aligns with credential harvesting and social engineering tactics commonly used in phishing campaigns. Infrastructure analysis reveals the domain linkedin-clone-green.vercel.app is hosted on IP 64.29.17.3 (US, AS16509 Amazon.com, Inc.) and was registered through Tucows Domains Inc. on February 21, 2026. The SSL certificate is issued by Google Trust Services (WR1). Detection metrics show 21 out of 95 security vendors on VirusTotal flag the domain as malicious. It appears on one security blocklist and is currently blocked by PhishDestroy. The domain remains active, increasing the risk of successful phishing attempts. Mitigation steps include immediate blocking of the domain and associated IP at the network perimeter. Security teams should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate thumbprint into endpoint detection and response (EDR) systems. User awareness training should emphasize identifying impersonation tactics, such as verifying URLs before entering credentials. Organizations should monitor for unauthorized access attempts linked to this campaign and enforce multi-factor authentication (MFA) to reduce credential theft impact.