amazonclone-two-gamma[.]vercel[.]app

The domain amazonclone-two-gamma.vercel.app was registered on July 16, 2025 and continues to resolve to IP 64.29.17.67, an address owned by AS16509 Amazon.com, Inc. The site serves HTTP 200 responses, employs Vercel hosting, presents an HSTS header, and presents a TLS certificate issued by Google Trust Services (WR1). The page title returned is "Amazon," matching the declared brand target of Amazon. Security‑intel sources have flagged the domain as a high‑risk brand‑impersonation site: PhishDestroy and PhishingDB have listed it in their blocklists, Google Safe Browsing labels it as SOCIAL_ENGINEERING, and 22 of 95 VirusTotal scanners report detections. Independent reputation services assign a Scamadviser score of 1/100 and a Gridinsoft score of 0/100, and the domain appears on two additional blocklists. While the observed metadata confirms a deliberate attempt to masquerade as Amazon, the actual page content has not been captured, leaving the specific phishing payload or credential‑collection mechanisms unknown. Defenders should immediately block the domain at network perimeters and DNS filters, monitor outbound connections to the associated IP, and consider adding the IP to threat‑intel feeds. Continuous re‑scanning of the site for content changes is advised, as the current evidence suggests an active infrastructure designed to deceive Amazon customers.