wayofsoul[.]tilda[.]ws

This domain, wayofsoul.tilda.ws, is currently under investigation for brand impersonation targeting Amazon. Analysis indicates the domain was registered on February 15, 2014, through a registrar and resolves to the IP address 194.48.203.16. The page title observed is 'New Private Tab,' which does not align with typical Amazon checkout or login page titles, suggesting an attempt to mimic private browsing sessions or obscure the true nature of the page. Infrastructure analysis reveals the domain is hosted with an SSL certificate issued by CentralNic Luxembourg Sàrl. While the domain has existed for over a decade, its current activity appears to involve impersonation of Amazon, as flagged by one security blocklist. The domain has not yet been detected by antivirus engines on VirusTotal, though this does not confirm its legitimacy. The lack of widespread detection may indicate either a low-volume campaign or the use of evasion techniques to avoid automated scanning. Defenders should note that the domain remains active and has been blocked by at least one security provider. The use of a long-standing domain may be an attempt to leverage existing reputation to bypass initial filters. Organizations are advised to monitor network traffic for connections to this domain, particularly in contexts involving Amazon-related branding or user authentication flows. If internal telemetry confirms interaction with this domain, incident response procedures should be initiated to assess potential credential theft or unauthorized data access. Further investigation is required to determine the full scope of the campaign, including whether the domain is part of a larger infrastructure or if it employs additional evasion techniques such as dynamic content loading or cloaking. At this stage, the domain should be treated as a potential threat until additional evidence confirms or refutes its malicious intent.