com-en-us[.]store

On 24 July 2026, the domain com-en-us.store was observed being used for a brand-impersonation campaign targeting Amazon. The domain was registered through Dynadot LLC on 21 February 2026 and is currently taken offline. DNS resolution points to the IP address 172.67.220.98, which belongs to AS13335 operated by Cloudflare, Inc., and the authoritative nameservers are rosa.ns.cloudflare.com and tom.ns.cloudflare.com. No TLS certificate is presented, indicating that the site was served over HTTP only. The only visible page title returned by the server is “Lumina | Smart Window Systems | 2026”, which does not reference the Amazon brand and suggests that the content has not been publicly analyzed.

Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification. VirusTotal analysis shows that six of ninety-three security vendors flagged the domain, and the domain appears on three independent security blocklists. Additional blocklist providers PhishDestroy, MetaMask, and SEAL have also listed the domain as malicious. The scam type is recorded as brand impersonation, and the intelligence explicitly states that the domain impersonates Amazon.

Because the site is offline, active payload delivery cannot be confirmed, but the combination of low trust score, multiple vendor detections, and blocklist listings indicates a high likelihood of phishing or credential‑stealing activity. Defenders should continue to block the domain at network perimeter, update DNS filtering rules, and monitor for any future re‑registration of the same second‑level name. Further investigation of the underlying web content, if the site becomes reachable again, would be required to determine the exact phishing vector and any harvested data. Until then, the domain should be treated as a confirmed elevated‑risk brand‑impersonation threat.