amazsurprisebox[.]com

Analysis of the domain amazsurprisebox.com indicates it was created on 25 February 2026 through the registrar GMO Internet, Inc. The domain resolves to IP address 34.160.105.222, which belongs to the AS396982 Google LLC network in the United States. DNS resolution is handled by the name servers a.share-dns.com, a1.share-dns.com, b.share-dns.net, and b1.share-dns.net. The site was secured with a Let’s Encrypt certificate (R12) and was classified by security scanners as a brand‑impersonation campaign targeting Google. VirusTotal records show that four of ninety‑one scanning engines flagged the domain, and it appears on a single external blocklist.

PhishDestroy has also listed the domain as blocked. Gridinsoft assigned a trust score of 1 out of 100, reflecting an extremely low reputation. The domain is currently offline, and no HTTP response or page title is available for further content analysis. Because the infrastructure points to a legitimate Google‑owned IP range, the operators likely leveraged cloud resources to host malicious pages while masking their true location.

Defenders should add amazsurprisebox.com to internal blocklists, monitor the associated IP range for any future activation, and watch for reuse of the same name‑server set in other campaigns. Continuous re‑scanning with multi‑engine services is advised to capture any changes in payload or hosting. Until the site is observed again, the primary mitigation focus remains on domain‑level blocking and network‑level observation.