minawakenhgaresortspa[.]agoda-us[.]com

Analysis classifies minawakenhgaresortspa.agoda-us.com as an elevated-risk brand_impersonation domain. The observed page title matched the impersonated brand indicator, suggesting an attempt to present content that could mislead users into believing they were interacting with a legitimate service. Although the site is currently offline, historical indicators support its classification as malicious infrastructure.

Infrastructure review shows the domain resolved to IP address 103.18.6.37 with geolocation in VN. Registration records indicate the domain was created on September 13, 2025 and registered through GMO Internet, Inc. Detection telemetry shows 23 of 95 security vendors flagged the domain. The host was associated with a Let's Encrypt / R12 SSL certificate. The domain appeared on 1 security blocklist and was blocked by PhishDestroy. Current status indicates the site has been taken offline, reducing immediate exposure but not eliminating residual risk from previously distributed links or cached content.

Recommended mitigation includes blocking the domain and associated indicators across DNS, web filtering, email security, and endpoint controls. Security teams should review logs for historical connections to the domain, investigate credential exposure related to brand impersonation scenarios, and reset potentially affected accounts where appropriate. User awareness efforts should emphasize verification of domain names before authentication or data submission. Continued monitoring for related infrastructure, lookalike domains, and IP-linked activity is advised due to the elevated-risk classification.