amazon[.]bepx[.]cc

This domain, amazon.bepx.cc, is a confirmed brand impersonation threat designed to harvest user credentials by mimicking Amazon’s payment processing pages. Analysis indicates the site was structured to deceive victims into entering login details, payment information, or other sensitive data under the guise of a legitimate transaction. The page title, 'Payment Pages,' further supports the intent to target financial or account verification workflows, a common tactic in credential theft campaigns. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on May 07, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 146.70.118.226, hosted on AS9009 (M247 Europe SRL) in Germany, a network segment with a history of hosting phishing infrastructure. Security vendors on VirusTotal flagged the domain at a rate of 21/95, and it appears on at least one blocklist. The SSL certificate, issued by Let's Encrypt (R13), provides encryption but does not validate legitimacy, as threat actors commonly exploit free certificate authorities to lend false credibility to malicious sites. Users who visited amazon.bepx.cc should take immediate corrective action to mitigate potential compromise. If any credentials or payment details were entered, reset passwords for Amazon and any other accounts using the same credentials, and enable multi-factor authentication where available. Monitor financial statements for unauthorized transactions and report suspicious activity to the relevant financial institution. Additionally, scan the device used to access the site for malware, as phishing pages may deploy secondary payloads. Given the domain’s current offline status, further interaction is unlikely, but vigilance for follow-up phishing attempts via email or other vectors is advised.