ismili[.]shop

Analysis of the domain ismili.shop indicates elevated risk of brand impersonation targeting Amazon, based on observable infrastructure and detection data. The domain was registered on September 29, 2025, through HOSTINGER operations, UAB, a registrar frequently associated with low-reputation domains. Infrastructure analysis reveals the domain resolves to the IP address 147.79.84.247, hosted under AS47583 (Hostinger International Limited) in Brazil. Nameservers ns1.dns-parking.com and ns2.dns-parking.com are configured, a pattern commonly observed in domains used for fraudulent activities due to their low oversight and ease of setup.

Security vendor detections on VirusTotal report 14 of 93 engines flagging the domain as malicious, a significant indicator of suspicious activity. Gridinsoft assigns a trust score of 0/100, further corroborating the domain's association with abusive behavior. The domain appears on one security blocklist, specifically PhishDestroy, and has been documented in one AlienVault OTX threat intelligence pulse, suggesting prior identification by the security community. The page title, 'AmazonBoxInc - Misteriozne Amazon kutije,' explicitly references Amazon, aligning with the reported scam type of brand impersonation.

No SSL certificate is present, which is atypical for legitimate e-commerce sites and increases the risk of data interception. The domain is currently offline, though this status may change; defenders should treat it as compromised infrastructure. The combination of brand impersonation, low trust scores, detection by multiple security vendors, and absence of basic security measures such as SSL indicates this domain was likely used in a phishing or scam campaign targeting Amazon customers. Organizations should block this domain at the DNS or proxy level and monitor for re-activation or similar domains registered through the same infrastructure or registrar.