amazonuvip[.]vip

The domain amazonuvip.vip is identified as a brand impersonation threat specifically targeting Amazon. Analysis confirms the domain was designed to mimic Amazon’s official branding, likely to deceive users into disclosing credentials or financial information. As of the latest verification, the domain has been taken offline, though prior activity indicates it was actively used in phishing operations. Technical indicators reveal multiple red flags. The domain was flagged by 17 of 95 security vendors on VirusTotal, signaling widespread detection as malicious. Registered on October 10, 2025, through Gname.com Pte. Ltd., the domain lacks an SSL certificate, a critical security omission for any legitimate transactional or login portal. Infrastructure analysis shows it resolved to the IP address 47.253.99.169, hosted under AS45102 (Alibaba (US) Technology Co., Ltd.), and appeared on two security blocklists, including PhishDestroy and PhishingDB. The page title, matching the domain name itself, further suggests a lack of effort to appear authentic. Current status confirms amazonuvip.vip is offline, reducing immediate exposure risk. However, the domain’s infrastructure and registration details remain a concern for potential reactivation or reuse. Organizations and users are advised to block the domain and its associated IP at the network level. Security teams should monitor for similar domains registered through the same registrar or resolving to the same IP range. End users who may have interacted with the domain should reset credentials for Amazon and any linked accounts, enable multi-factor authentication, and review financial statements for unauthorized activity.