by[.]byqgwcgzs[.]cn

The domain by.byqgwcgzs.cn has been assessed as having an elevated risk level due to its specific threat type of brand impersonation. This domain impersonates Amazon, a well-known e-commerce brand, and is designed to deceive users into believing they are interacting with a legitimate Amazon service.

Analysis indicates that by.byqgwcgzs.cn was flagged by 20 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion among the security community. The domain was registered through Guangzhou Yunxun Information Technology Co., Ltd., and it resolves to the IP address 103.217.207.157, which is located in China (AS146817 Hubei Feixun Network Co., Ltd). The domain was created on April 16, 2023, and has appeared on 2 security blocklists, including PhishDestroy and PhishingDB. The SSL certificate for this domain is issued by Let's Encrypt / R13, which is a common certificate authority used by legitimate and malicious sites alike. The page title, '跨境电商物流单号网,DHL单号,USPS单号,FEDEX单号!', suggests that the site may be impersonating a logistics or tracking service related to Amazon.

To mitigate the risks associated with this brand impersonation domain, users should be educated to verify the URL of any website they visit, especially those purporting to be associated with Amazon. Security teams should implement DNS and IP-based blocking rules to prevent access to 103.217.207.157 and by.byqgwcgzs.cn. Additionally, monitoring for similar domain names and IP addresses can help identify and block related malicious activities. It is also recommended to configure firewalls and web filters to block access to known malicious domains and IP addresses listed in security blocklists.