gobamalltk[.]org

The domain gobamalltk.org has been identified as a phishing site specifically impersonating Amazon, a major e-commerce platform. This infrastructure was operational for credential harvesting, tricking users into submitting login credentials, payment details, or personal information under false pretenses. Analysis indicates the site is currently offline, though its prior activity poses residual risks to users who may have interacted with it during its active period. Infrastructure analysis reveals the domain was registered through Dynadot Inc on June 09, 2026, and resolved to the IP address 161.248.15.131. Security telemetry shows it was flagged by 15 of 95 vendors on VirusTotal, indicating moderate to high detection rates across the security community. The domain appears on one security blocklist and has been referenced in two threat intelligence pulses on AlienVault OTX, suggesting its inclusion in broader phishing campaigns. Additionally, the domain holds a Gridinsoft trust score of 0/100, reinforcing its malicious classification. Current status confirms the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the infrastructure may reappear under a different domain or IP address, a common tactic in phishing operations. Organizations and individuals are advised to block the domain gobamalltk.org and its associated IP 161.248.15.131 at the network level. Users who may have visited the site should reset credentials for any accounts accessed during the interaction, enable multi-factor authentication, and monitor financial statements for unauthorized activity. Security teams should review logs for connections to the domain or IP to identify potential compromises.