amazonhgyu[.]shop

Analysis of amazonhgyu.shop indicates a recently observed e‑commerce phishing infrastructure that has been taken offline as of the report date. The domain was registered through the KURUN-CGNT-NET-7 registrar and is hosted on IP 38.148.240.143, which belongs to AS8796 FASTNET DATA INC in the United States. No TLS certificate is present, meaning the site only responded over HTTP before being disabled. The hosting environment uses the shared DNS providers a.share-dns.com and b.share-dns.net.

Reputation metrics are extremely poor: Gridinsoft assigns a score of 0/100, Scamadviser rates the site at 1/100, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the domain, and AlienVault OTX references it in sixteen threat‑intelligence pulses. VirusTotal reports fifteen of ninety‑five security vendors flagging the domain, reinforcing the malicious classification. The identified scam type is an e‑commerce scam, consistent with the targeting pattern of fraudulent retail sites.

Concrete evidence beyond the infrastructure and reputation data is not available because the site is offline and no page title or content has been captured. Consequently, uncertainty remains about the exact phishing payload and any credential‑harvesting mechanisms that may have been employed. Defenders should continue to block the domain at network and DNS layers, monitor the associated IP address for any re‑use, and add the domain to internal blacklists. Ongoing threat‑intel feeds should be consulted for any re‑appearance, and users should be warned that any future requests to amazonhgyu.shop are likely malicious.