jys[.]zcpay[.]vip

This domain is classified as a high-risk brand impersonation threat targeting Amazon users. Analysis indicates the site was designed to deceive visitors into divulging sensitive credentials, payment details, or personal information by mimicking the legitimate Amazon platform. The page title explicitly displays 'Amazon,' reinforcing the fraudulent intent to exploit brand trust and user familiarity. Infrastructure analysis reveals the domain jys.zcpay.vip was registered through GoDaddy.com, LLC on May 11, 2026, and resolves to the IP address 206.82.8.10, hosted by XLC INC in the United States. Security vendor detections on VirusTotal report 22 out of 95 engines flagging the domain as malicious. The domain appears on three distinct security blocklists, including PhishDestroy, MetaMask, and SEAL, while Google Safe Browsing has explicitly categorized it as a phishing site. The SSL certificate, issued by Let's Encrypt (R12), provides basic encryption but does not mitigate the underlying fraudulent activity. To mitigate risks associated with this brand impersonation threat, organizations and individuals should immediately block the domain and its resolving IP address within network security controls. End users should be educated on recognizing phishing indicators, such as mismatched URLs, suspicious registration dates, and unsolicited requests for credentials. Security teams are advised to monitor for related domains registered under the same infrastructure or registrar, as threat actors frequently reuse hosting providers and IP ranges for subsequent campaigns. If credentials were entered on this site, affected accounts should be secured through password resets and multi-factor authentication enforcement.