amazon-associatese568[.]rollout[.]site

On July 23, 2026, analysis was performed on the domain amazon-associatese568.rollout.site. The site resolves to the IPv4 address 37.72.169.170, which is announced by AS29802 HIVELOCITY, Inc. and geolocated to the United States. The domain is registered through NameCheap, Inc. and was created on October 24, 2024. DNS resolution uses the authoritative nameservers coco.bunny.net and kiki.bunny.net. The TLS certificate presented is issued by SSL2BUY EMEA LLC under the SSL2BUY EMEA RSA Domain Validation Secure Server CA, indicating a commercially supplied certificate rather than a self‑signed one.

The page title returned by the HTTP service reads “Amazon Associates – Earn Money with the Amazon Affiliate Program,” matching the declared brand target of Amazon and the classified scam type of an e‑commerce impersonation. VirusTotal has recorded detections from 15 of 95 scanning engines, confirming that a significant portion of security vendors consider the domain malicious. Google Safe Browsing also classifies the site as a social‑engineering threat, and the domain appears on one external security blocklist. PhishDestroy has taken the site offline and lists it as blocked. Scamadviser assigns a trust score of 1 out of 100, reinforcing the low credibility of the hosting infrastructure.

The observable evidence points to a classic brand‑impersonation campaign that leverages a legitimate‑looking Amazon Associates landing page to lure victims into an e‑commerce fraud funnel. While the site is currently offline, the underlying IP address, nameserver pattern, and certificate provider have been reused in prior campaigns, suggesting potential reuse in future operations. Defenders should therefore add the IPv4 address 37.72.169.170 and the full domain name to network‑level blocklists, monitor for new subdomains under rollout.site that resolve to the same nameservers, and enforce strict URL filtering for any Amazon‑related affiliate content originating from untrusted certificates.