emailnotificationz[.]com

Analysis of emailnotificationz.com indicates a credential phishing campaign with elevated risk, currently offline as of July 23, 2026. The domain was registered on March 26, 2026, through Amazon Registrar, Inc., and resolves to IP address 32.194.4.181, hosted on AWS EC2 in the us-east-1 region. Infrastructure analysis reveals the use of Nginx and HTTP Strict Transport Security (HSTS), alongside an SSL certificate issued by Amazon, suggesting an attempt to appear legitimate. The domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 14 of 94 security vendors on VirusTotal, confirming its classification as malicious.

The HTTP status returned is 404, indicating the phishing page is no longer accessible, though this does not preclude reactivation. Nameservers are hosted under AWS DNS (awsdns-62.org, awsdns-02.com, awsdns-56.co.uk), consistent with threat actors leveraging cloud infrastructure for scalability and evasion. No specific brand impersonation or phishing kit details are available in the current intelligence, limiting attribution beyond the credential phishing classification. Defenders should treat this domain as compromised and maintain blocklist entries for its IP and domain.

Monitoring for reactivation or shifts in hosting (e.g., IP changes, nameserver updates) is recommended. If internal logs show user interaction with this domain prior to its takedown, credential reset protocols should be initiated for affected accounts. Given the use of AWS infrastructure, reviewing cloud security policies for unauthorized deployments may help identify related threat activity.