ht[.]ht1[.]htgyuguuu[.]xyz

This domain is flagged for elevated-risk brand impersonation targeting Amazon customers. Analysis indicates the site was designed to deceive users into entering credentials or payment details under the guise of an official Amazon storefront, as evidenced by the page title 'Amazon' and the absence of an SSL certificate, increasing the likelihood of credential interception. Infrastructure analysis reveals the domain ht.ht1.htgyuguuu.xyz was registered on December 28, 2025, through Chengdu West Dimension Digital Technology Co., LTD. It resolves to the IP address 154.92.22.53, hosted under AS138152 (YISU CLOUD LTD) in the United States. Detection metrics show 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The domain currently lacks SSL encryption, further reducing its legitimacy and increasing exposure to man-in-the-middle attacks. Mitigation steps for this threat type include blocking the domain at the network level, particularly for endpoints accessing e-commerce or financial services. Organizations should monitor for connections to 154.92.22.53 and the AS138152 range, as these may indicate compromised hosts. End users should be trained to verify domain authenticity before entering credentials, especially on sites lacking SSL certificates. Security teams are advised to correlate this domain with other known Amazon impersonation campaigns to identify broader patterns of abuse.