boushaq150cm[.]tithelysetup[.]com

The domain boushaq150cm.tithelysetup.com has been identified as a high‑risk brand‑impersonation site targeting Facebook. The public page title returned by HTTP is “Boushaq150cm”. No additional page content has been captured, so the exact visual or functional elements remain unverified. The domain is currently active and continues to resolve.

Infrastructure analysis shows the domain resolves to the Amazon‑owned IP address 52.35.132.113, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. Authoritative nameservers are ns‑1299.awsdns‑34.org, ns‑1789.awsdns‑31.co.uk, ns‑251.awsdns‑31.com and ns‑794.awsdns, confirming Amazon Route 53 as the DNS provider. The SSL certificate requires SNI for validation, indicating a standard cloud‑based TLS deployment.

Reputation services flag the site as malicious. VirusTotal records 11 out of 95 security vendors marking the domain as malicious. Scamadviser assigns a trust score of 1 / 100, and Gridinsoft reports a score of 0 / 100. The domain appears on two independent blocklists, PhishDestroy and PhishingDB, and is listed as blocked by both. HTTP requests return a 403 status, which may be used to obscure content.

Defenders should add boushaq150cm.tithelysetup.com and its resolved IP 52.35.132.113 to network deny lists and update email filtering rules to block any URLs containing the domain. Continuous monitoring of DNS queries for the four Amazon nameservers can help detect future repurposing. Given the confirmed impersonation of Facebook, organizations should educate users about unexpected login prompts and enforce multi‑factor authentication to mitigate credential harvesting.