ems[.]account-info[.]email

The phishing domain ems.account-info.email has been taken down but was active as a threat until recently. It is flagged as malicious by 5 out of 91 vendors on VirusTotal and is listed on one public blocklist, specifically PhishDestroy's. This domain was first detected on June 20, 2026, and was hosted on an IP address managed by Amazon in the United States.

The domain's registration through Amazon Registrar, Inc. and its hosting by Amazon.com, Inc. suggest a sophisticated setup, potentially designed to exploit trust in Amazon's infrastructure. The SSL certificate issued by Amazon further adds a layer of perceived legitimacy, which could deceive users into believing they are interacting with a legitimate service.

The domain's platform risk score of 63 out of 100 indicates a moderate threat level. This score reflects the domain's potential to cause harm through phishing activities. Despite the domain being offline now, its prior activity highlights the ongoing need for vigilance against such threats. PhishDestroy's early detection capabilities allowed for the identification and mitigation of this phishing operation before it could cause widespread damage.