m[.]amazonuu[.]com

On 23 July 2026, analysts observed the domain m.amazonuu.com, registered on 28 November 2025 through Chengdu west dimension digital technology Co., LTD. The domain is configured to resolve to IP address 23.247.128.154, which is owned by AS138152 YISU CLOUD LTD and geolocated to the United States. Name server records point to ns3.myhostadmin.net and ns4.myhostadmin.net. No TLS certificate is presented for the host, indicating that the site is served over plain HTTP only. An HTTP request to the root URL returns a page whose title is the Chinese phrase “没有找到站点”, which translates to “Site not found”.

The page content has not been publicly archived, and the site is currently offline, limiting direct observation of any malicious payloads or credential‑capture forms. VirusTotal reports that 17 out of 95 scanned security vendors flagged the domain as malicious, providing independent corroboration of its suspicious nature. The domain appears on a single public phishing blocklist and has been actively blocked by the PhishDestroy service, reflecting its recognition by at least one industry‑operated mitigation platform. The threat is categorized as an E‑Commerce scam that impersonates the Amazon brand, consistent with the “Brand target: Amazon” label in the intelligence feed.

Given the lack of SSL protection, the presence of a Chinese‑language error page, and the association with a known phishing blocklist, the infrastructure appears to have been deliberately taken offline, possibly in response to takedown efforts. Defenders should continue to monitor the IP address 23.247.128.154 for any re‑use in future campaigns, enforce outbound web filtering for the exact domain name, and add the host to internal blocklists. Organizations that rely on Amazon services should be aware that this domain may have been used in past credential‑harvesting attempts and should review any authentication logs for connections to the IP range of YISU CLOUD LTD during the active period.