amppouda[.]pages[.]dev

PhishDestroy identifies amppouda.pages.dev as a live Amazon gift card phishing campaign impersonating the retail giant to harvest credentials and financial data. The domain leverages Cloudflare Pages hosting under pages.dev to bypass traditional email security filters, resolving to IP 188.114.97.3 with a valid Let’s Encrypt SSL certificate to appear trustworthy. This infrastructure choice and certificate issuance heighten the risk of successful social engineering, especially among users accustomed to legitimate *.pages.dev subdomains. Analysis reveals zero detections on VirusTotal (1/95 engines) as of the latest scan, indicating the campaign remains under the radar of automated scanners. The domain is registered through Cloudflare, Inc., which provides both anonymity and performance benefits to threat actors. With no current blocklist presence, users may encounter this page unfiltered via phishing emails, fake ads, or social media redirects, increasing exposure risk. If you visited amppouda.pages.dev or entered any information, immediately revoke any shared passwords, monitor bank statements for unauthorized transactions, and scan devices with updated antivirus software. Report the domain to Amazon via their official phishing portal and consider using a password manager with anti-phishing detection to prevent future exposure. This campaign is active and evolving—stay vigilant.