amazon-clone-gamma-ecru[.]vercel[.]app

This domain, amazon-clone-gamma-ecru.vercel.app, is identified as a high-risk brand impersonation campaign targeting Amazon users. Analysis indicates the threat actor has deployed a credential theft scheme, presenting a cloned interface titled 'Amazon Clone' to deceive victims into submitting login credentials. The domain exhibits no overt indicators of crypto drainer functionality but focuses on harvesting sensitive account information through deceptive branding and layout replication. Infrastructure analysis reveals the domain was registered through Vercel Inc. on January 28, 2020, and resolves to the IP address 64.29.17.131, hosted within AS16509 (Amazon.com, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WR1), adding a superficial layer of legitimacy. Detection metrics show 21 of 95 security vendors on VirusTotal flag the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on a single security blocklist, suggesting limited but targeted detection efforts. As of the latest assessment, the domain remains active and unresolved, posing an ongoing risk to users. No takedown actions have been observed, and the infrastructure continues to operate under Vercel’s hosting. Organizations and individuals are advised to block the domain and IP address at the network level, while users should be alerted to the presence of this credential theft campaign. Continuous monitoring is recommended due to the domain’s persistence and the potential for further abuse of the Amazon brand.