mylittleladies[.]blog[.]verifytoken[.]com

The domain mylittleladies.blog.verifytoken.com was observed hosting a credential‑phishing campaign targeting users of an unspecified brand, as indicated by the scam classification “Brand Impersonation”. The site returned an HTTP 404 response with the page title “404 - Quick Tip | Cofense”, suggesting that the phishing landing page has been removed or taken offline. Infrastructure analysis shows the domain resolves to IP address 34.194.247.17, which belongs to Amazon.com, Inc. (ASN 14618) and is located in the United States. The hosting provider is Amazon Web Services; the four authoritative nameservers are ns-1123.awsdns-12.org, ns-1659.awsdns-15.co.uk, ns-453.awsdns-56.com, and ns-638.awsdns-?.

The domain was registered through MarkMonitor, Inc. on 21 March 2011, a registrar commonly used by legitimate enterprises, which may aid evasion. The TLS certificate is issued by Let’s Encrypt (R12), providing standard encryption but offering no indication of malicious intent. Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, the domain appears on one security blocklist, and PhishDestroy has flagged it as malicious. VirusTotal analysis recorded five positive detections out of ninety‑one scanners, reinforcing the suspicion of phishing activity.

The site’s current status is offline, and no additional content was captured during the scan. Confidence in the phishing classification is high based on the combined evidence, but the exact brand being spoofed and the phishing kit employed remain unknown. Defenders should block the domain at the network perimeter, add the associated IP address to deny‑list rules, and monitor for any future DNS resolution to the same IP range. Continuous observation of the registrar’s new registrations and the AWS name‑server set is recommended to catch any re‑use of the infrastructure.