jyhbzgth[.]xyz

This domain, jyhbzgth.xyz, is actively impersonating Amazon to deceive users into engaging with fraudulent product listings. The site displays a fake Amazon page advertising a bulk candy variety pack, a tactic designed to lure victims into entering payment details or personal information under the guise of a legitimate purchase. Brand impersonation of this nature typically aims to harvest credentials, financial data, or distribute malware through fake checkout processes or downloadable content. Users who interact with such sites risk identity theft, unauthorized transactions, or device compromise. Analysis indicates this domain is a confirmed threat based on multiple technical indicators. It is flagged by 10 out of 95 security vendors on VirusTotal, including detection for social engineering by Google Safe Browsing. The domain was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to the IP address 128.241.231.182, which has been linked to other fraudulent activities. The SSL certificate, issued by Let's Encrypt, provides encryption but does not validate the legitimacy of the site. Additionally, the domain appears on one security blocklist and has a trust score of 0/100, reinforcing its malicious classification. If you visited jyhbzgth.xyz or entered any information on the site, immediate action is required to mitigate potential risks. First, disconnect the device from the internet to prevent further data transmission. Run a full system scan using updated security software to detect and remove any malware or unauthorized applications. Change passwords for all accounts accessed from the compromised device, prioritizing financial and email accounts, and enable multi-factor authentication where available. Monitor bank statements and credit reports for unauthorized transactions or signs of identity theft. If payment details were entered, contact your financial institution to report potential fraud and request a card replacement. Report the domain to relevant authorities or cybersecurity organizations to assist in takedown efforts and prevent further victimization.