webmail[.]192-241-250-80[.]cprapid[.]com

The domain webmail.192-241-250-80.cprapid.com was observed pointing to the IP address 23.208.220.78, which belongs to AS16625 Akamai Technologies, Inc. and is geolocated in the United States. Registration records show the domain was created on May 16, 2019 and is registered through Tucows Domains Inc., with authoritative name servers ns1.pdns.tech, ns2.pdns.tech and ns3.pdns.tech. No SSL certificate is presented for the host, indicating that traffic to the site would have been unencrypted. A page title retrieved from the site reads “Amazon.com. Spend less.

Smile more.”, and the intelligence flags the domain as impersonating the Amazon brand for credential phishing. VirusTotal scans flagged the domain by nine out of ninety‑five security vendors, and the Gridinsoft trust score is recorded as 0 / 100, reflecting a high confidence of malicious intent. The site is currently listed as offline, and it has been blocked by the PhishDestroy service and appears on one additional security blocklist. These indicators collectively confirm that the domain was used for an Amazon‑targeted credential‑phishing campaign.

Because the site is no longer reachable, detailed analysis of the landing page content, form fields, or malicious payloads is not possible, leaving the exact phishing workflow uncertain. Defensive teams should continue to block the domain and its associated IP address at perimeter firewalls and DNS filtering layers, monitor for any re‑registration attempts, and add the observed nameserver set to watchlists for future abuse. Ongoing surveillance of the AS16625 prefix is advisable, as it may host other malicious actors leveraging the same hosting infrastructure. The combination of brand impersonation, low trust score, multiple vendor detections, and blocklist listings warrants an elevated risk rating and immediate mitigation actions.