savebig40[.]com

Analysis of the domain savebig40.com shows a short‑lived infrastructure that was created on March 12, 2026 and subsequently taken offline, returning HTTP status code 451 before removal. The domain resolves to the IP address 216.198.79.1, which is hosted in the United States and is part of ASN 16509 owned by Amazon.com, Inc. Hosting on Amazon’s network is consistent with the observed deployment of Vercel services, and the site presented an HSTS header, indicating that TLS was enforced. The SSL certificate is issued by Let’s Encrypt (R13), a free certificate authority frequently used by malicious operators to obtain rapid HTTPS coverage. Registration was performed through NameCheap, Inc., and the authoritative nameservers are dns1.registrar-servers.com and dns2.registrar-servers.com.

The page title captured from the site – “Fenty Beauty – Claim Your $100 Gift Card” – directly points to a brand‑impersonation campaign targeting Fenty Beauty customers. The threat type is listed as generic phishing, and the scam classification is brand impersonation. Two of ninety‑four VirusTotal scanners flagged the domain, and it appears on one external security blocklist. PhishDestroy has also listed the domain as blocked.

While the site is no longer reachable, the combination of a newly registered domain, rapid deployment on a reputable cloud provider, a valid TLS certificate, and early detection by multiple vendors suggests a purposeful attempt to harvest credentials or lure victims with a fraudulent gift‑card offer. Defenders should continue to block the domain at perimeter defenses, monitor for any re‑registration attempts, and consider adding the associated IP range to threat‑intel feeds. Further investigation of related domains that share the same nameserver set or resolve to the same IP may reveal additional components of the campaign.