bnttiz[.]shop

Analysis of bnttiz.shop, created on 19 June 2026 and currently taken offline, identifies a credential‑phishing operation that impersonates Amazon. The site served a page titled “Amazon Sign‑In”, indicating a direct attempt to harvest Amazon user credentials. Infrastructure evidence shows the domain resolves to IP 185.255.198.196, an address allocated to BACK WAVES LIMITED (AS153371) in the United States. The hosting provider is Cloudflare, as indicated by the authoritative nameservers roan.ns.cloudflare.com and zelda.ns.cloudflare.com. The domain uses a Let’s Encrypt /YR2 SSL certificate, which provides HTTPS encryption but does not confer legitimacy. Registration was performed through GNAME.COM PTE.

LTD., a registrar known to host a variety of malicious domains. Risk scoring from Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist. VirusTotal analysis reports that 18 of 91 scanning engines flagged the domain, corroborating its malicious nature. PhishDestroy has also blocked the site, confirming its classification as a credential‑phishing vector. Defenders should immediately add bnttiz.shop and its resolving IP address to network deny lists and DNS filtering policies. Monitoring for any resurgence of the domain or reuse of the same IP block is recommended, as the infrastructure could be repurposed for future campaigns.

Security teams should also audit authentication logs for any Amazon‑related login attempts originating from the identified IP range and enforce multi‑factor authentication for Amazon accounts where possible. Continuous threat‑intel feeds should be consulted for new indicators tied to the registrar GNAME.COM PTE. LTD. or the AS153371 network, as adversaries often recycle these assets. The combination of low trust scores, multiple vendor detections, and confirmed brand impersonation underscores the elevated risk posed by this domain.