amazon-clone-amber-five[.]vercel[.]app

PhishDestroy identifies the domain amazon-clone-amber-five.vercel.app as an active generic phishing campaign designed to mimic Amazon’s login portal. The threat involves a counterfeit credential harvesting page, likely deployed to siphon user credentials or session tokens. Based on internal telemetry, this infrastructure aligns with common crypto-drainer or credential theft kits that automate the extraction of sensitive data for downstream fraud or account takeover operations.

Technical analysis reveals a sparse footprint with limited detection coverage: VirusTotal currently flags the domain with 23/95 detections, indicating evasion against most signature-based defenses. The domain resolves to IPv4 address 64.29.17.3, hosted on Vercel’s cloud platform and secured with a Google Trust Services SSL certificate. Google Safe Browsing has already tagged this domain under the SOCIAL_ENGINEERING category, though no public blocklists have yet incorporated this indicator. Registration metadata and historical WHOIS data suggest recent deployment, consistent with the domain’s transient nature.

This phishing domain remains active and under active investigation by PhishDestroy analysts. Immediate containment is challenged by Vercel’s infrastructure and the absence of third-party blocklist adoption. Users are strongly advised to avoid interacting with this domain and to verify all Amazon-related links via PhishDestroy’s real-time validation tool. Remaining risk is classified as HIGH due to the domain’s active status, low detection rate, and direct impersonation of a major retail brand.