fefaewfaew[.]top

Analysis of the domain fefaewfaew.top indicates it was created on 18 December 2025 through NameSilo, LLC. The domain resolves to the IPv4 address 172.67.159.239, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. Both authoritative nameservers – jakub.ns.cloudflare.com and vida.ns.cloudflare.com – are hosted by Cloudflare, consistent with the observed hosting arrangement. The TLS certificate presented by the site is identified as "WE1", a Cloudflare‑issued certificate covering the exact hostname, confirming that the domain is served over HTTPS. Threat intelligence sources classify the site as an e‑commerce scam that impersonates the Amazon brand. The impersonation claim is corroborated by the "Impersonates: amazon" tag in the supplied data.

The domain appears on a single security blocklist and has been explicitly flagged by the PhishDestroy blocklist. VirusTotal analysis shows that 19 of 93 scanned security vendors raise detections for the domain, indicating a moderate level of consensus about malicious intent. The current operational status is recorded as "offline", suggesting that the hosting service has been taken down or the site is no longer serving content. No HTTP status code, page title, or Safe Browsing result is available, leaving the exact visual or functional characteristics of the site unverified. Likewise, no Open Threat Exchange identifiers or additional external reputation scores are provided.

Defenders should treat fefaewfaew.top as a high‑confidence malicious indicator. Immediate actions include adding the domain and its resolving IP address (172.67.159.239) to outbound and inbound deny lists, confirming that any existing Cloudflare‑based DNS resolvers are configured to block the associated nameservers, and monitoring for future registrations that reuse the same registrar or nameserver pattern.