amzuu[.]icu

This domain, amzuu.icu, is identified as a brand impersonation threat targeting Amazon. The page title explicitly displays 'Amazon,' and the infrastructure is designed to mimic legitimate Amazon login or account management portals. No evidence of a crypto drainer kit or payment skimming script was observed in initial scans, though the site primarily functions as a credential harvesting platform. The domain’s design and content structure align with known Amazon-themed phishing campaigns, where victims are lured into entering sensitive account details under false pretenses. Analysis indicates the following technical indicators: the domain is flagged by 16 out of 95 security vendors on VirusTotal, suggesting moderate to high confidence in its malicious classification. It was registered through CHENGDU WEST DIMENSION DIGITAL TECHNOLOGY CO., LTD., a registrar frequently associated with high-risk domains. The domain resolves to the IP address 154.92.22.53, hosted under AS138152 (YISU CLOUD LTD), an autonomous system previously linked to phishing and fraudulent activities. The domain was created on January 01, 2026, an unusually future-dated registration that may indicate an attempt to evade reputation-based detection systems. It appears on one security blocklist and is not currently listed in Google Safe Browsing (GSB) at the time of analysis. The SSL certificate is issued by R12, a low-assurance certificate authority often used in transient or disposable phishing infrastructure. As of the latest assessment, amzuu.icu has been taken offline, reducing immediate exposure to potential victims. However, the domain remains registered, and the underlying infrastructure (IP, registrar, and hosting provider) has not been dismantled. Historical patterns suggest that similar domains may resurface under different names or IP addresses, leveraging the same registrar and hosting environment. Users who may have interacted with this domain are advised to rotate credentials, particularly for Amazon accounts, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and its associated IP address to prevent future access attempts. The elevated risk level persists due to the domain’s registration status and the registrar’s historical association with malicious activity.