amazonclone-wheat[.]vercel[.]app

Analysis of amazonclone-wheat.vercel.app indicates an active brand-impersonation domain targeting Amazon users. The domain was registered on August 30, 2025, through Vercel Inc. and remains operational as of July 23, 2026. Infrastructure analysis reveals hosting on IP 216.198.79.195, geolocated in the US under AS16509 (Amazon.com, Inc.), though this does not confirm legitimate affiliation. The site presents a page title matching the targeted brand and returns an HTTP 200 status, suggesting a functional frontend. Technical indicators show the domain is flagged by 22 of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it as social engineering.

It appears on at least one security blocklist and is actively blocked by PhishDestroy. Trust scores from Scamadviser and Gridinsoft both report 1/100 and 0/100, respectively, reinforcing its high-risk classification. The SSL certificate is issued by Google Trust Services (WR1), a common feature in both legitimate and malicious deployments. The scam type is classified as an e-commerce scam, though specific mechanics—such as payment interception, credential harvesting, or fraudulent product listings—remain unconfirmed due to limited public telemetry. Technologies detected include Vercel’s hosting platform and HTTP Strict Transport Security (HSTS), which may be leveraged to lend superficial legitimacy.

No evidence links this domain to known phishing kits or actor infrastructure at this time. Defenders should prioritize blocking the domain and its resolving IP at network and endpoint layers. Security teams are advised to monitor for user reports of fraudulent transactions or account compromise linked to this domain. Further investigation into associated payment gateways, backend APIs, or linked domains may reveal additional infrastructure. Given the domain’s recent creation and persistent activity, continued monitoring for shifts in detection coverage or hosting changes is recommended.