amazon-affiliates-links-generator[.]pages[.]dev

PhishDestroy identifies the domain amazon-affiliates-links-generator.pages.dev as an active credential theft scam targeting Amazon Associates program participants. This domain employs brand impersonation tactics, presenting itself as a fraudulent tool for generating affiliate links while secretly harvesting login credentials. The infrastructure appears designed to exploit trust in Amazon’s affiliate program, potentially leading to unauthorized account access or financial losses for victims.

Technical indicators reveal the domain resolves to IP 172.66.47.119, registered through Cloudflare, Inc., with a Google Trust Services SSL certificate. VirusTotal currently reports 0/95 detections, and the domain remains unflagged by Google Safe Browsing (GSB). The absence of detections suggests this threat may be newly emerged or employing evasion techniques. As of this advisory, the domain remains active with no known blocklist entries.

This domain is under active investigation with a risk level classified as 'under_investigation' despite its current operational status. Users encountering this domain should avoid interaction and report it to Amazon’s abuse team or PhishDestroy. The lack of detections underscores the need for heightened vigilance, as traditional security tools may not yet recognize this threat. Remaining risk includes ongoing credential theft and potential expansion into broader phishing campaigns leveraging Amazon’s brand equity.