amz-sipv[.]icu

The domain amz-sipv.icu was registered on February 21, 2026 and is presently taken offline. Registration records show the registrant as Chengdu west dimension digital technology Co., LTD, and the authoritative name servers are ns3.myhostadmin.net and ns4.myhostadmin.net. DNS resolution points to IP address 154.92.22.53, which belongs to AS138152 YISU CLOUD LTD and is geolocated in the United States. No SSL certificate is presented on the host, indicating that HTTPS was not configured.

The HTTP response presents a page title of "Amazon," aligning with the declared brand impersonation of Amazon. Threat intelligence sources have identified the domain in three AlienVault OTX pulses, and it is listed on one external security blocklist. Independent reputation services rate the domain poorly, with Gridinsoft assigning a trust score of 0 out of 100 and Scamadviser reporting a score of 1 out of 100. VirusTotal analysis shows that 20 of 93 scanning engines flagged the domain as malicious, reinforcing the suspicion of abusive activity.

PhishDestroy has already added the domain to its block list, and the current status is recorded as offline, suggesting that active hosting may have been terminated or taken down. While the available data confirms the infrastructure and brand‑impersonation intent, the actual content of the site was not captured, leaving the specific phishing payload or credential‑harvesting mechanisms undocumented. Defenders should continue to block the resolved IP address and the domain name across network perimeter controls, monitor for re‑hosting attempts or similar domains using the same registrar or name‑server pattern, and incorporate the observed threat indicators—such as the lack of TLS, the low trust scores, and the OTX pulse references—into detection rules and threat‑intel feeds. Ongoing vigilance is recommended to catch any resurgence or derivative campaigns that may reuse the same brand‑targeting approach.