In the first week of June 2026, Check Point Research watched the Amazon brand get cloned 6,843 times. Not in customer chats. Not in fake reviews. In the registry itself — 6,843 freshly registered domains carrying some variant of the Amazon name, all spun up in the runway to Prime Day. One out of every thirteen was already classified as explicitly malicious or suspicious before the sale even started.
The number is not a curiosity. It is the operational signature of a phishing economy that has stopped being a cottage industry and started being a factory. At seven thousand new lookalike domains across a single week, no human inbox-monitoring team, no manual takedown workflow, no eyes-on-the-padlock advice column has any chance of keeping up. The defense has to move down to the layer where the attack actually lives — DNS, WHOIS, hosting infrastructure, and the SSL plumbing the attackers now ship with for free.
The scale of Prime Day 2026
Two numbers from the Check Point report do most of the work in describing what changed this year.
- 6,843 Amazon-themed domains registered in the lead-up window. That is roughly one new lookalike domain every eighty-eight seconds, sustained for days.
- 1 in 13 of those domains was already flagged as malicious or suspicious. Extrapolated across the cluster, that is hundreds of live phishing properties pointing at the same target audience at the same time.
A single threat actor in the data set registered 46 domains centered on the keyword amazoncredito — a coordinated cluster aimed at Spanish-speaking shoppers, complete with customer-service-flavored subdomains, fake payment portals, and valid SSL across the board.
The illusion of legitimacy
The phishing pages flagged in the Prime Day 2026 cluster did not look obviously broken. They looked authoritative on purpose. Three engineering shifts explain why the old “just look carefully” advice has stopped working.
- Automated domain generation. Attackers no longer hand-pick names. They run dictionaries against Amazon’s service surface —
amazon-billing,amzn-support,prime-rewards,amazoncredito-pago— and bulk-register the long tail across cheap TLDs (.shop,.online,.top) in single API calls. - Close-match customer service framing. The branding language inside these sites mimics transactional emails: refund, dispute, verify, claim. The visual layout is lifted pixel-for-pixel. The footer carries copyright text that scrapes verbatim from amazon.com.
- Valid SSL by default. Every domain in the cluster ships with a free DV certificate — Let’s Encrypt, ZeroSSL, or a CDN-issued cert applied automatically at provisioning time. The padlock icon is now a tool of the attacker, not a defense against them.
The combination is what defeats the user-facing safety checklist. Spelling looks right. Layout looks right. The URL is plausible if you do not stare at it. The browser shows a padlock. Every consumer-grade heuristic comes back green. The fraud lives one layer below — in the registration metadata, the hosting fingerprint, and the mail server config that no normal shopper will ever look at.
Domainscan’s multi-data point analysis
Domainscan is built for exactly this layer. Instead of asking does this URL look right, it asks several harder questions in parallel and correlates the answers. String matching alone produces noise; correlated infrastructure signals produce verdicts.
DNS and WHOIS velocity
Real retailers do not register their primary brand domains the week of a sale. Phishing operators do — that is the entire business model. Domainscan reads the registration timeline directly:
- Registration date versus the campaign window. A domain whose WHOIS
creation_datesits inside the last seven days, on a brand-keyword name, is a near-certain red flag. - Nameserver and A-record churn. Legitimate brands rarely flip DNS configuration daily. Phishing infrastructure does — pointing to new IPs as takedowns hit the old ones.
- Registrar choice. A handful of bulk registrars are statistically over-represented in abuse data. Brand-keyword domain plus high-abuse registrar plus week-old creation date is a hard signal.
Registrant and domain clustering
The Prime Day cluster did not produce 6,843 unrelated actors. It produced a much smaller number of operators each running large fleets. Domain clustering finds those fleets by walking the shared edges between domains:
- Shared IP addresses. Hundreds of brand-lookalike domains resolving to one origin server is not a coincidence. It is one operator running a phishing kit at scale.
- Naming pattern fingerprints. Suffix and prefix templates (
-pago,-soporte,-credito) repeat across registrations. A single template is a cluster signature. - Registrar plus nameserver pairs. Operators tend to reuse infrastructure choices. Identical registrar plus identical NS records across dozens of brand-lookalike domains identifies a single actor instantly.
Catching one of these domains is interesting. Catching the cluster — the other 45 in the amazoncredito network, mapped from one seed — is what actually disrupts the campaign.
Hosting IP and MX record reputation
Phishing rarely lives in isolation. The fake site needs somewhere to receive harvested credentials, forward password resets, and respond to verification emails. That is where the mail exchanger — the MX record — gives the operator away.
- Missing or fresh MX records. A legitimate retailer’s mail infrastructure is years old and well-known. A lookalike domain with no MX, or an MX configured to a free mail relay set up last week, is a credential-harvesting front, not a business.
- MX hostname reputation. Some mail relays appear disproportionately in phishing forensics. Cross-referencing the MX hostname against historical abuse data catches harvesters that pass every other surface check.
- Hosting IP history. An IP that hosted three other Amazon-themed domains last month is not a neutral piece of infrastructure. Reverse-IP and historical-passive-DNS data turn one suspicious domain into a map of related operations.
Prism AI: the visual and contextual verification engine
Infrastructure signals catch infrastructure attackers. But the last mile of a phishing campaign is still visual — the cloned logo, the spoofed checkout form, the hidden POST endpoint that ships the card number off to a server nobody verified. Prism AI is built to inspect that surface in milliseconds and correlate it with the infrastructure verdict Domainscan already produced.
- Component-level deconstruction. Prism AI parses the rendered page into its constituents — images, forms, scripts, network destinations — and evaluates each against a model of how the real brand renders. Logo lifted from amazon.com? Form posting to
amazoncredito.shop? Script loading from a domain registered yesterday? Each is its own flag. - Visual anomaly detection. Color spacing, font substitution, layout drift, and image re-encoding artifacts are signatures that traditional firewalls cannot see. Prism AI catches the things a security appliance running on URL allowlists will always miss.
- Form-destination inspection. Every form’s actual
actionURL is followed and verified. A login form on a page that looks like Amazon, posting to an unrelated third-party endpoint, is the unambiguous fingerprint of a credential harvester — and Prism AI reports the destination explicitly so the user sees what the browser hid.
From reactive security to proactive infrastructure defense
The 6,843 Amazon-themed domains in the Prime Day 2026 dataset are not an aberration. They are the new baseline. Every major retail event from here forward — Black Friday, Diwali, Boxing Day, back-to-school — will draw the same industrial-scale impersonation. Security teams and individual shoppers cannot keep up by reading URLs more carefully. The infrastructure has to do the reading.
That is what infrastructure-level defense actually means: WHOIS, DNS, hosting, MX, SSL chain, and page-level rendering all evaluated together, in milliseconds, against the historical and behavioral patterns of known abuse. It is the only model that matches the speed and scale of the threat.
If you are a user, do not enter a payment detail on a domain you have not run through an infrastructure check. If you are a security team, do not depend on inbox reports — depend on telemetry. Either way, the next phishing wave is already registered. The question is whether you read its WHOIS before it reads your card number.
Source
Original research and figures from Check Point Research, reported in The Next Web: Amazon Prime Day 2026 scam domains — Check Point phishing report.