# amazon.deviceperks.com — MALICIOUS

> Investigate amazon.deviceperks.com, a high-risk domain mimicking Amazon with 18/95 VirusTotal detections. Full report available.

## Summary
PhishDestroy identifies amazon.deviceperks.com as an active credential-harvesting domain operating under an elevated risk classification. This infrastructure specifically targets Amazon customers by masquerading as an authentic rewards program portal, aiming to harvest login credentials and payment details through spoofed login interfaces.

This domain was flagged by 18 of 95 participating VirusTotal security vendors and is currently resolving to IP address 16.58.105.167. The domain, registered through GoDaddy.com, LLC on September 09, 2025, holds an SSL certificate issued in Amazon's name, enhancing its deceptive legitimacy. Despite this certification, various domain reputation services and blocklists have independently flagged the domain due to consistent patterns of phishing-related behavior. The combination of recent registration, high detection ratio, and falsified authentication credentials significantly increases the likelihood of successful compromise.

Organizations and end users should immediately block traffic to 16.58.105.167 at network perimeter devices and DNS resolvers. Users who may have accessed this domain should rotate Amazon account passwords immediately, enable multi-factor authentication, and review recent orders for unauthorized transactions. Implementing custom IDS/IPS rules to detect HTTP(S) requests containing patterns such as 'amazon.deviceperks.com/login' or 'deviceperks' in user-agent strings can further reduce exposure. Report any observed activity involving this domain to Amazon’s anti-phishing teams and relevant CERTs with available telemetry. Regularly audit DNS logs and browser security extensions to identify potential follow-on compromise from this campaign.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-09-09 13:48:39
- Registrar: GoDaddy.com, LLC
- IP: 16.58.105.167

## Detection Status
- VirusTotal: 18 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/24e34b62-3f4e-46a1-9e68-8fd69a1c01d1
- PhishDestroy: https://phishdestroy.io/domain/amazon.deviceperks.com/
- LLM endpoint: https://phishdestroy.io/domain/amazon.deviceperks.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/amazon.deviceperks.com/
Last updated: 2026-03-22