am[.]rdiyn[.]shop

This domain, am.rdiyn.shop, poses a high-risk brand impersonation threat targeting users of a major technology company. The site displays a page titled 'AMAZON' despite being designed to mimic Google, suggesting an attempt to deceive visitors into believing they are interacting with legitimate services. Such impersonation schemes often aim to harvest login credentials, personal data, or distribute malware under false pretenses. Users encountering this domain may be tricked into entering sensitive information, which could lead to account compromise or financial loss. Analysis indicates the domain is actively malicious, with 7 out of 95 security vendors on VirusTotal flagging it as harmful. It resolves to the IP address 188.114.97.3, hosted on Cloudflare’s infrastructure (AS13335), and uses an SSL certificate issued by Google Trust Services (WE1). The domain appears on one security blocklist and is currently blocked by at least one anti-phishing system. Despite its deceptive page title, the infrastructure and detection patterns confirm its intent to impersonate Google rather than Amazon, highlighting a deliberate misdirection tactic. If you visited am.rdiyn.shop or interacted with its content, take immediate action to mitigate potential risks. Disconnect the device from the network to prevent further data transmission. Run a full antivirus scan to detect and remove any malware. Change passwords for any accounts accessed from the compromised device, prioritizing email, financial, and work-related services. Enable multi-factor authentication where available. Monitor accounts for unauthorized activity and report suspicious transactions to the relevant service providers. Avoid reusing passwords across platforms to limit the impact of credential theft.