amspresale[.]vip

The domain amspresale.vip was observed as a brand‑impersonation site targeting Amazon. The site’s page title, "Amazon Pre‑Sale for AMS (up to 100% bonus)", explicitly references the Amazon brand, confirming the intent to lure victims with a false pre‑sale offering. Infrastructure analysis shows the domain resolves to IP address 185.121.120.27, which is assigned to Latitude.sh LTDA (AS262287) and geolocated in the United States. No SSL certificate is present, indicating the site operated over plain HTTP, and the domain is currently offline.

Reputation services flag the domain as highly untrustworthy: Scamadviser assigns a trust score of 1 / 100, while Gridinsoft rates it at 0 / 100. The domain was blocked by the PhishDestroy service and appears on a single security blocklist, suggesting at least one external mitigation source recognized the threat. VirusTotal scanned the host and recorded detections from seven of ninety‑five security vendors, providing additional corroboration of malicious behavior. Nameserver information is not available, and no further details about the hosting environment have been disclosed.

Defenders should treat amspresale.vip as a confirmed malicious indicator. Immediate mitigation actions include adding the domain and its resolved IP address to outbound and inbound blocklists, updating DNS filtering policies to deny resolution, and incorporating the domain into threat‑intel feeds. Continuous monitoring for re‑registration or similar domains that reference Amazon or use comparable naming patterns is advised, as actors often recycle infrastructure after takedown. Given the low trust scores and multiple vendor detections, the risk posture remains elevated despite the current offline status, and proactive blocking is recommended to prevent potential victim exposure.