fantiniairschool[.]com

Analysis of fantiniairschool.com indicates a brand‑impersonation campaign targeting Amazon. The domain was registered on March 21, 2025 through NameCheap, Inc., and resolves to the IP address 162.0.235.244, which is assigned to AS22612 (Namecheap, Inc.) in the United States. No SSL certificate is presented, and the site currently returns an offline HTTP status, suggesting the infrastructure has been taken down or is temporarily unavailable.

The sole page title observed, "MAXWIN5000: MARAPTHON SEASON 2 - Welcome To Thousand Sunny," does not reference Amazon but demonstrates that the content is unrelated to the claimed brand, a common tactic in deceptive domains. VirusTotal analysis shows that one of ninety‑five security vendors flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service.

While the exact payload or credential‑collection mechanisms remain unverified—no page content or form details are available—the combination of registrar, hosting IP, lack of TLS, and detection signals constitute sufficient evidence for defensive action. Organizations should add fantiniairschool.com to DNS and proxy blocklists, deny traffic to its hosting IP, and monitor NameCheap‑registered domains for similar Amazon‑impersonation patterns. Continuous threat‑intel feeds should be consulted for any re‑hosting attempts, and security teams are advised to alert users about unsolicited communications that reference Amazon but originate from unrelated or obscure domains.