americawin[.]com

Analysis indicates that the domain americawin.com is currently active and returns an HTTP 302 redirect. The public page title reads “AmericaWin.com is for sale | HugeDomains”, suggesting the domain is parked on a marketplace. The domain resolves to the IP address 104.26.6.37, which belongs to an Amazon Web Services EC2 instance in the us-east-1 region. Nameservers are nsg1.namebrightdns.com and nsg2.namebrightdns.com, consistent with registration through TurnCommerce, Inc. DBA NameBright.com. The certificate presented is a Let’s Encrypt E8 certificate, indicating TLS is enabled. Security telemetry shows the domain appears on one blocklist and has been flagged by PhishDestroy. Two of 91 VirusTotal scanners have reported detections, and the Gridinsoft trust score is 0 out of 100, reinforcing a high‑risk assessment. Detected web technologies include CFML, Microsoft ASP.NET, Adobe ColdFusion, Typekit, reCAPTCHA, jQuery, Google Analytics, and embedded YouTube content, which are common components of credential‑phishing pages. The listed scam type is credential phishing, although the exact payload or credential‑harvesting page has not been observed. At present, no definitive content beyond the parking page is available, so the precise phishing vector remains uncertain. Defenders should block or sinkhole the domain, monitor DNS queries for the IP 104.26.6.37, and add the domain to internal blocklists. Continuous re‑scanning is recommended to detect any future changes in content or additional detections.