ckpn[.]io

This domain, ckpn.io, is identified as an active brand impersonation threat targeting Amazon users. Analysis confirms the domain is designed to deceive visitors through fraudulent credential harvesting, a tactic commonly associated with phishing operations impersonating major e-commerce platforms. The domain is currently offline, but prior activity indicates it was operational for malicious purposes. Infrastructure analysis reveals ckpn.io was flagged by 20 of 95 security vendors on VirusTotal, indicating broad detection of its malicious nature. The domain was registered on March 20, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolved to the IP address 216.150.1.1, hosted under AS19871 (Network Solutions, LLC), and appears on one security blocklist. The SSL certificate was issued by Let's Encrypt (R12), a common choice for both legitimate and malicious domains due to its accessibility. The page title, 'Quick Link Shortener,' suggests an attempt to disguise the domain's true intent under a generic service facade. As of the latest assessment, ckpn.io has been taken offline, reducing immediate risk to end users. However, the domain's infrastructure and registration details remain suspicious. Organizations and individuals are advised to block this domain at the network level and monitor for any reactivation attempts. Users who may have interacted with the domain should reset credentials for Amazon and any other accounts accessed during the suspected exposure period. Security teams should review logs for connections to 216.150.1.1 and correlate with other known indicators of compromise associated with brand impersonation campaigns.