zk66666[.]com

PhishDestroy identifies zk66666.com as a live phishing domain posing as an Amazon AWS login portal, actively harvesting user credentials since its creation on July 24, 2025. This domain resolves to Amazon’s IP 18.66.122.5 and leverages an Amazon-issued SSL certificate to appear legitimate, tricking visitors into submitting sensitive login information. The threat actor behind this campaign registered the domain through GoDaddy.com, LLC, exploiting the trust associated with Amazon’s infrastructure to bypass initial skepticism. This domain was flagged by security researchers with 1/95 detections on VirusTotal as of the latest scan, indicating it has evaded immediate detection by mainstream antivirus engines. Its recent registration date—just days ago—suggests a rushed deployment to capitalize on unsuspecting users. The combination of an Amazon IP, SSL certificate, and low detection rate makes it a high-risk vector for credential theft, particularly targeting individuals or employees who may unknowingly interact with the fake login page. Users who visited zk66666.com should immediately change any passwords entered on the site and enable multi-factor authentication (MFA) on their Amazon and other critical accounts. Avoid interacting with the domain further, and report it to your IT security team or via phishing reporting tools like the FBI’s IC3 or your email provider’s spam filters. Monitor financial accounts and enable credit monitoring if sensitive credentials were submitted. If the domain appears in unsolicited emails or messages, delete it without clicking any embedded links.