google-clone-me[.]vercel[.]app

Domain google-clone-me.vercel.app is actively engaged in a brand-impersonation campaign targeting Google users, according to ongoing SOC analysis under seed 3d5523. The page is currently classified as a social-engineering threat and remains active across the threat landscape.

This domain was flagged by 18 of 95 VirusTotal vendors at last scan, indicating limited but concerning detection coverage. It resolves to IP 64.29.17.67 via Vercel Inc. registration services, leveraging a Google Trust Services SSL certificate to enhance credibility. Google Safe Browsing has already listed the domain under the “SOCIAL_ENGINEERING” category, confirming malicious intent despite the absence of broader AV detections.

Given the domain’s dual use of Google branding and Vercel hosting—combined with the SSL certificate issued by Google Trust Services—it presents a credible lure for credential harvesting or malware delivery. Immediate defensive actions include DNS blocking of 64.29.17.67, certificate revocation review with Google Trust Services, and user advisories to avoid interactions with google-clone-me.vercel.app. SOC teams should monitor for related subdomains under vercel.app and update blocklists accordingly to prevent downstream compromise.