Cybersecurity researchers have identified nearly 7,000 fake Amazon-themed domainsregistered in the six months leading up to Prime Day 2026, which begins today, June 23. Check Point Research tracked 6,843 new domains created between December 2025 and May 2026, with registrations peaking at 1,446 in April and remaining elevated at 1,267 in May.
Of the total, 9.2% were classified as malicious or suspicious. The rate increased sharply in early June.
Prime Day 2026 runs from June 23 to 26 in 22 countries, with four additional markets added later in the summer, according to Amazon's official event page. The global reach makes it a high-value target for phishing operations, which follow the same seasonal pattern that researchers documented around the FIFA World Cup, where over 13,000 fake domains appeared in the months leading up to the event.
See also: Amazon Prime Video faces ban due to Nokia
Amazon Prime Day 2026: How the attacks work
The phishing infrastructure includes fake Amazon stores designed to collect credit card numbers, fake login pages that steal account credentials , and email campaigns with subjects like “Refund, Amazon System Error” that direct recipients to fake websites. Check Point points out one campaign that uses a sender address that mimics Amazon’s customer service domain.
One notable example involves targeting Hispanic shoppers. Check Point identified 46 domains registered under the “amazoncredito” pattern, all linked to a single registrar. They target Latin American markets, where Amazon has expanded its Prime membership.
See also: Amazon's Prime Video improves user experience
The attackers’ tactics are not new, but the scale continues to grow. Google recently sued a Chinese cybercrime group that used AI to create phishing code and operated a million fake domains, showing how cheap and automated domain-based fraud has become. Check Point’s findings suggest that Amazon-themed businesses are following the same industry pattern, with thousands of domains registered months in advance and activated as shopping events approach.
Protection
Check Point recommended that shoppers type amazon.com directly into their browser instead of clicking links in emails or ads, enable two-factor authentication on their Amazon accounts , and treat any non-refund notifications as suspicious. The company also advised looking for HTTPS and padlock icons, though it noted that fake websites are increasingly using valid SSL certificates to appear legitimate.
See also: Amazon Music introduces ads and removes downloads for some Prime members
The timing is significant because Prime Day has become one of the largest online shopping events worldwide, generating billions in revenue and attracting millions of new bargain hunters who may be less familiar with phishing tactics. Amazon has not publicly commented on Check Point's findings.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
