8qdqsk[.]356739[.]net

On 23 July 2026 the domain 8qdqsk.356739.net was identified as a high‑risk brand‑impersonation site targeting Amazon. The site was registered on 21 February 2026 through Dominet (HK) Limited and uses the Cloudflare nameservers james.ns.cloudflare.com and sasha.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is advertised as belonging to ASN 13335 (Cloudflare, Inc.) and geolocated to the United States. No TLS certificate is presented; the HTTP response is delivered over plain HTTP and the page title returned by the server is the static string “REX”. The domain is listed on one external security blocklist and is actively blocked by the PhishDestroy feed.

Google Safe Browsing classifies the URL as a social‑engineering threat. A VirusTotal scan performed prior to takedown recorded 12 of 93 antivirus engines flagging the domain as malicious. Independent scoring by Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The site has been taken offline at the time of reporting.

Evidence confirms that the domain is being used to impersonate the Amazon brand, consistent with the “Brand Impersonation” tag in the intelligence set. No additional artifacts such as login pages, credential‑harvesting forms, or payload binaries have been captured, leaving the exact user‑facing technique uncertain. Defenders should immediately add 8qdqsk.356739.net to URL filtering and DNS‑blocking policies, monitor traffic to the hosting IP 188.114.97.3 and related Cloudflare ranges, and consider automated ingestion of the domain and its associated indicators into threat‑intel platforms. Ongoing surveillance for newly registered subdomains or domains sharing the same registrar and nameserver configuration is advised, as the infrastructure pattern may be reused in future campaigns.