m[.]cratgyamyi[.]net

This domain m.cratgyamyi.net is currently offline, but historical evidence indicates it was used for a generic phishing operation. The domain was registered on March 06, 2026 through Amazon Registrar, Inc. and resolves to the IP address 3.174.46.116, which is assigned to AS16509 Amazon.com, Inc. and geolocated in Germany. Authoritative nameservers listed are ns-1196.awsdns-21.org, ns-1237.awsdns-26.org, ns-1755.awsdns-27.co.uk, and ns-1927.awsd. No TLS certificate was observed, confirming the site was served over plain HTTP. VirusTotal analysis shows that five of ninety‑five scanning engines flagged the domain, indicating malicious behavior.

The domain is listed on one external security blocklist and has been explicitly blocked by the PhishDestroy sinkhole. The page title returned by the site is “Cratgyamyi”, which does not correspond to a known brand or service, reinforcing the generic nature of the phishing attempt. The elevated risk rating reflects the combination of recent creation, association with Amazon hosting, and detection by multiple security vendors. Uncertainty remains regarding the specific content that was delivered to victims, as no page capture or login form details are available.

The lack of an SSL certificate suggests the site may have been a simple landing page used to harvest credentials or redirect users. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same IP address or associated nameservers, and include the domain in threat‑intel feeds. Additional investigation of traffic logs for connections to 3.174.46.116 may reveal compromised user activity. Because the infrastructure is hosted on a major cloud provider, rapid re‑deployment is possible; continuous observation of the associated AWS nameservers is recommended.