torvex7[.]vip

This domain, torvex7.vip, is identified as an active phishing infrastructure designed to impersonate the Amazon brand. The site presents a fraudulent login interface under the page title 'Amazon,' aiming to harvest user credentials, payment details, or personal information. Such campaigns typically exploit brand recognition to deceive victims into entering sensitive data, which is then exfiltrated to attacker-controlled servers for financial fraud or identity theft. Analysis indicates the domain was registered on March 8, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with malicious activity. It resolves to the IP address 43.110.34.237, hosted under AS45102 (Alibaba (US) Technology Co., Ltd.), and utilizes an SSL certificate issued by PhishDestroy, a known indicator of phishing infrastructure. The domain appears on one security blocklist and is flagged by 22 out of 95 security vendors on VirusTotal, confirming its malicious classification. The certificate issuer, botadmin.destroy.tools, further corroborates its association with automated phishing toolkits. Users who visited torvex7.vip should immediately revoke any entered credentials, particularly Amazon account logins or financial details. It is recommended to monitor associated accounts for unauthorized activity and enable multi-factor authentication where available. Devices used to access the site should undergo a security scan to detect potential malware or data exfiltration. If payment information was submitted, affected parties should contact their financial institution to prevent fraudulent transactions. Organizations should update blocklists to include this domain and its resolving IP to mitigate further exposure.