help[.]nsdaghfak[.]sbs

Analysis of the domain help.nsdaghfak.sbs indicates a high‑risk brand‑impersonation campaign targeting Amazon. The domain was registered on August 16, 2025 through NameSilo, LLC and resolves to the IPv4 address 172.81.133.163, which belongs to AS27176 DataWagon LLC in the United States. DNS resolution uses the authoritative nameservers ns1.dnsowl.com, ns2.dnsowl.com and ns3.dnsowl.com. No TLS certificate is presented, meaning the site operates without HTTPS encryption. The page title retrieved from the server reads “The Intertwined Destinies: Amazon & The Amazon,” confirming the intent to reference the Amazon brand.

VirusTotal records show that 14 of 95 scanning engines have flagged the domain, reflecting a consensus of malicious intent. Google Safe Browsing classifies the URL as social engineering, and the site appears on the PhishDestroy blocklist, which currently lists the domain as blocked. Gridinsoft assigns a trust score of 0 out of 100, indicating maximal suspicion. The domain is presently offline, which may be the result of takedown efforts or temporary hosting changes. Evidence beyond the listed indicators—such as the specific payload, credential‑stealing forms, or hosting of malicious files—has not been captured.

Defenders should continue to monitor the IP address 172.81.133.163 for any reactivation, update network and endpoint blocklists to include the domain and its associated nameservers, and enforce strict outbound filtering for traffic to the identified IP range. Because the site lacks TLS, any attempted connections would be unencrypted, providing an additional vector for detection. Organizations that rely on Amazon services should educate users about the deceptive page title and reinforce existing phishing‑awareness training. Ongoing intelligence collection is recommended to capture any future infrastructure changes or content variations.