brochures-video[.]com

This domain, brochures-video.com, is confirmed to host generic phishing infrastructure targeting Amazon Prime users. Analysis of the page title, 'Facture détaillée – Amazon Prime Video · OrderV3,' indicates the site impersonates Amazon Prime Video's billing system to deceive victims into divulging payment details or account credentials. No specific drainer kit signatures were identified, but the 'OrderV3' component suggests a modular phishing framework designed for scalability and evasion. The attack leverages invoice-themed lures, a common tactic to exploit urgency and trust in financial communications. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 18 out of 95 security vendors on VirusTotal, indicating moderate to high detection rates. It was registered through TUCOWS.COM, CO. on June 11, 2026, and resolves to the IP address 104.194.144.61, hosted on AS198983 (Joseph Hofmann trading as 'Tornado Datacenter GmbH & Co. KG'). The domain appears on one security blocklist and uses a Let's Encrypt SSL certificate issued to 'YE2,' a common pattern in phishing campaigns to mimic legitimacy. The creation date is anomalous, as it predates the current year, suggesting potential domain spoofing or registry manipulation. As of the latest assessment, brochures-video.com has been taken offline, likely due to automated takedown mechanisms or hosting provider intervention. However, the elevated risk level persists due to the domain's prior activity and the potential for infrastructure reuse. Users who interacted with the site should assume credential exposure and initiate password resets for Amazon Prime and linked accounts. Organizations are advised to monitor for related domains using similar naming conventions (e.g., 'brochures-[brand].com') and block the IP 104.194.144.61 at the network level. The hosting provider, Tornado Datacenter GmbH & Co. KG, has been linked to other phishing campaigns, warranting continued scrutiny of its address space.