kotamahjong[.]org[.]pafiikn[.]org

The domain kotamahjong.org.pafiikn.org is presently offline but exhibits multiple indicators of a brand‑impersonation campaign targeting Amazon. Registration data shows the domain was created on May 04, 2024 through NameCheap, Inc., and it resolves to the IP address 66.29.149.92, which belongs to AS22612 (Namecheap, Inc.) and is geolocated in the United States. Authoritative DNS records list ns1.pafiikn.org and ns2.pafiikn.org as the nameservers. No SSL certificate is associated with the host, confirming the lack of HTTPS protection.

The site’s sole observed page title, "DESAMAHJONG: Situs Slot Glamor Viral Slot777 Mudah Sekali Cuan," does not reference Amazon directly, suggesting that the phishing page content has not been captured or is no longer accessible. Threat intelligence feeds flag the domain as a brand‑impersonation vector, and it appears on one security blocklist. PhishDestroy has actively blocked the domain, and the Gridinsoft trust score is 0 out of 100, indicating a high confidence of malicious intent. VirusTotal analysis shows that 16 of 93 security vendors have flagged the domain, reinforcing the suspicion of abuse.

While the site is currently taken offline, the underlying infrastructure—namely the hosting IP and the dedicated nameservers—remains under the control of the same registrar and could be reused for future campaigns. Defenders should continue to block the domain and the associated IP address at network perimeters, add the host to internal blacklists, and monitor the nameserver entries for any re‑activation. Additionally, surveillance of the registrar’s newly registered domains that resolve to the same IP or share the pafiikn.org naming pattern is advised to detect potential re‑deployment of the malicious infrastructure.