1,284 New “Amazon” Sites Were Registered Last Month. One in Every 16 Is Already Flagged. (2026)

Likely a fake store — unless you typed amazon.com yourself. Check Point Research counted 1,284 new Amazon- and Prime-themed domains registered in September 2026, with one in every 16 already flagged malicious or suspicious — and the named clusters, like the AmazonShopping/ShoppingOnAmazon Numbered Network, are built for login theft, not bargains. A fake storefront takes your card once; a fake login page takes the saved cards, addresses, and order history inside your whole account. The top US lure is a billing or renewal notice — including “Amazon Financial Services” card-update emails — and the real Message Center at amazon.com lists every genuine email.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — October 6, 2026 →

Straight from the source

The verdict stands on the public record — the line below is quoted verbatim from the source named under it.

“New Amazon- and Prime Day-related domain registrations have risen for three straight months, climbing from 905 in July 2026 to 1,284 in September 2026—an increase of 42%.”

— Check Point Research, October 1, 2026.

Why you’re seeing this now

Prime Big Deal Days runs October 6–7 — and the lookalikes were built first. Check Point Research found registrations rising three straight months to September's 1,284 (up 37% on last year), with 6.5% of September's crop already classified malicious or suspicious: one in every 16. The named clusters are built for login theft, not bargains — the AmazonShopping/ShoppingOnAmazon Numbered Network (eleven domains, ten malicious) and the AmazonGlobal Numbered Domains (five, all malicious) — with addresses like amazonprime-support.com, primevideoamazon.com, and amazonprimeusa.com. KnowBe4's threat lab counted a 188% jump in Amazon impersonations from late August into September, 700+ themed domains in three weeks, three-quarters of campaigns reshaping themselves to dodge filters; the top US lure is a billing or renewal notice — including “Amazon Financial Services” emails asking you to update your card through their link. A fake storefront takes your card once. A fake login page takes the saved cards, addresses, and order history inside your whole account. Type amazon.com yourself — the real Message Center lists every genuine email.

Five red flags — any one is enough

A “Big Deal Days” deal arrives by text, email, or social ad carrying its own link — Amazon sells only on amazon.com and its own app.

The address is close-but-not-Amazon: amazonprime-support.com, primevideoamazon.com, amazonprimeusa.com — real malicious domains registered this season.

A “support” or “Prime Video” page asks for your Amazon password — a fake storefront steals your card once; your password steals everything saved in the account.

An “Amazon Financial Services” email says your payment method needs updating through its link.

Flawless writing and perfect logos — AI removed the typo tell. The URL in your address bar is the one thing they can't copy.

Your next three moves

Verify through a channel you open yourself — type amazon.com into your browser or open the Amazon app, and check the Message Center there: it lists every genuine email Amazon has sent you. A billing or renewal problem that exists only in the email doesn't exist.

Refuse the ask: no Amazon password typed into a “support” or “Prime Video” page a message linked you to, and no card “update” through an “Amazon Financial Services” email link. Amazon sells only on amazon.com and its own app — a deal on any other address isn't Amazon.

Report the store or email at reportfraud.ftc.gov and to Amazon at [email protected] — and paste the link from the ad, email, or post into the $2 instant check for a 0–100 scam risk score before you enter your card or password anywhere it leads.

Is an email from “Amazon Financial Services” real?

No. Researchers blocked roughly 100 unique Prime-themed scam emails in the two weeks before the event, several impersonating exactly that name. A genuine payment problem appears inside your account at amazon.com — never as a link in an email.

The URL says amazon-something.com — is that Amazon?

No. Only exactly amazon.com (or the official app). Hyphenated and reordered variants were registered by scammers for this sale window.

I already entered my card or password on a lookalike site — what now?

Cancel the card with your issuer, change your Amazon password at amazon.com typed yourself, turn on two-step verification, watch statements, and report at ReportFraud.ftc.gov.

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Spot the scam before it spots you.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.