amazon-verification[.]org

amazon-verification.org is a recently activated domain posing as an Amazon verification portal to harvest user credentials and payment details. This domain mimics legitimate Amazon services to trick victims into entering sensitive login or financial information, which is then exfiltrated to attacker-controlled servers. Unlike typical phishing sites that rely on poor grammar or obvious red flags, this domain leverages Cloudflare’s infrastructure and a Google Trust Services SSL certificate to appear legitimate, increasing its chances of deceiving targets. This domain was flagged by PhishDestroy with 1 out of 95 VirusTotal detections at the time of analysis, indicating it remains under the radar of most detection engines. Registered through Cloudflare, Inc., the domain was created on May 29, 2025, and currently resolves to IP address 188.114.97.3. Its recent creation and low detection rate suggest it may be part of a rapidly evolving campaign targeting unsuspecting Amazon users. Despite its professional appearance, the domain is designed to exploit trust in Amazon’s brand to facilitate credential theft and financial fraud. If you or someone in your organization has visited amazon-verification.org, immediately check for unauthorized transactions or account access. Avoid entering any credentials or payment details on this domain, and scan your devices for malware. Report the domain to Amazon’s abuse team and block the IP 188.114.97.3 at your network perimeter. Update passwords for critical accounts, enable multi-factor authentication, and remain vigilant for follow-up phishing attempts leveraging this scam.