amazan[.]com

Analysis of amazan.com indicates active credential phishing infrastructure targeting the Amazon brand. The domain was registered on May 27, 2026 through Ascio Technologies, Inc. (Denmark/USA) and resolves to IP 172.234.27.37, an address owned by Akamai Technologies, Inc. in the United States. DNS resolution uses ns1.parklogic.com and ns2.parklogic.com, and the MX record points to mx156.hostedmxserver.com (priority 10). The site presents an HTTP 200 response with the page title "Redirecting..." and serves a Let's Encrypt/E8 TLS certificate. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports three detections out of ninety‑one scanned scanners. The domain appears on one public blocklist and is actively blocked by PhishDestroy. AlienVault OTX references the domain in two threat intelligence pulses, confirming its inclusion in broader malicious activity monitoring. While the exact phishing landing page content has not been captured, the combination of brand impersonation metadata, low trust score, multiple vendor detections, and blocklist presence strongly suggests a credential harvesting campaign. Defenders should add amazan.com to DNS and web‑filter blocklists, monitor for outbound connections to the associated IP, and consider updating threat‑intel feeds to include the observed indicators. Continuous observation of any changes to the domain's registration, hosting, or TLS configuration is recommended to detect potential shifts in operation.