amazprimebox[.]com

This domain, amazprimebox.com, is actively engaged in credential phishing targeting Amazon users. Analysis indicates the site mimics legitimate Amazon login portals to harvest account credentials, payment details, and personal information. The phishing pages are designed to deceive users into entering sensitive data under the guise of account verification, order confirmation, or subscription renewal prompts. Given the domain's focus on Amazon, victims are likely lured through phishing emails, SMS, or malvertising campaigns that impersonate official Amazon communications. Infrastructure analysis reveals the domain was registered on June 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It currently resolves to the IP address 34.49.19.166 and uses a Let's Encrypt SSL certificate to present a false sense of security. VirusTotal detections show 10 out of 95 security vendors have flagged this domain as malicious, with classifications including phishing, fraud, and credential theft. No legitimate blocklist entries or sinkhole data were identified, but the domain remains operational and unmitigated as of this report. Users who have visited amazprimebox.com or entered credentials on the site should immediately revoke any submitted information. Steps include changing Amazon account passwords, enabling multi-factor authentication, and reviewing recent account activity for unauthorized transactions. Financial institutions should be notified if payment details were disclosed. Devices used to access the domain should undergo a malware scan to detect potential secondary infections, such as keyloggers or remote access trojans. Network-level blocking of the domain and its resolving IP (34.49.19.166) is recommended to prevent further exposure. Organizations should update email and web filtering rules to quarantine messages containing this domain or related phishing lures.