w33onm9q[.]top

This domain, w33onm9q.top, operates as a credential theft site specifically impersonating Amazon's beauty product category. Analysis indicates the page title 'Amazon.com : beauty' was used to deceive users into entering login credentials, payment details, or personal information under false pretenses. The threat targets Amazon customers searching for beauty products, exploiting brand recognition to harvest sensitive data for fraudulent transactions or account takeovers. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered through Spaceship, Inc. on May 03, 2026, with an anomalous future creation date suggesting potential registrar manipulation or typo-squatting tactics. It resolves to IP address 103.20.192.127, hosted in Hong Kong under AS135357 (HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED). VirusTotal reports 20 out of 95 security vendors flagging this domain as malicious, while one security blocklist has already incorporated it into their detection rules. The absence of an SSL certificate further reduces legitimacy and increases exposure to man-in-the-middle attacks. Users who visited w33onm9q.top should immediately take protective measures. First, reset any credentials entered on the site, particularly Amazon account passwords and associated payment methods. Enable multi-factor authentication on all critical accounts to prevent unauthorized access. Monitor financial statements for unauthorized transactions and report suspicious activity to relevant financial institutions. If browser sessions were active during the visit, clear all cached data and run a full antivirus scan to detect potential malware or tracking scripts. Given the elevated risk level, consider notifying security teams if this domain was accessed in corporate environments.