amazon-music-unlimited-apk20250607[.]pages[.]dev

This domain, amazon-music-unlimited-apk20250607.pages.dev, is currently active and engaged in a credential theft campaign targeting users of the Amazon Music service. Analysis indicates the site impersonates Amazon’s official branding to harvest login credentials, payment details, or personal information under the pretense of offering an "Amazon Music Unlimited APK." The page title, "Unlock Amazon Music Unlimited APK: Stream Music," reinforces the deception by mimicking legitimate service promotions. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 30, 2026, and resolves to the IP address 172.66.47.71, located in a Cloudflare data center in California. The domain appears on one security blocklist, specifically PhishDestroy, though it remains undetected by 95 VirusTotal vendors as of the latest scan. The SSL certificate is issued by Google Trust Services (WE1), a common practice for both legitimate and malicious sites leveraging Cloudflare’s infrastructure. The low detection rate and recent creation date suggest the campaign may still be in its early stages or employing evasion techniques. The current status of the domain remains active, with no indications of takedown or mitigation. Users are advised to avoid interacting with the site, particularly entering credentials or downloading files. Organizations should update blocklists to include this domain and its associated IP address. Security teams are encouraged to monitor for similar patterns, such as newly registered Cloudflare domains impersonating major brands, and prioritize credential theft detection mechanisms for domains mimicking Amazon or other high-value targets.