public company · US
Amazon
AMAZON COM INC
Retail and cloud services.
- Primary official domain
- amazon.com
- Reviewed official domains
- 4 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
35
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
46
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC quarantine
SPF -all · 4/10 lookups · Mail: Receives mail (1 MX host) · checked 2026-10-19 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- amazon
- Label aliases
- Amazon · Amazon.com
- Official domains
- amazon.com · amazon.co.uk · amazon.de · amazonaws.com (all)
- Generated spellings
- 371 tracked · 231 observed somewhere · 140 not observed (all)
- Can receive mail
- 27 spellings and 16 reported domains publish MX records · mail at Above.com parking (parking placeholder) 5 · Google 5 · h-email.net (parking placeholder) 3 · 27 more (231 spellings and 35 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
amazon-book-business-course[.]comMail: MXSPF · checked 2026-10-19mail at mx.services · sends via Ukraine.com.ua | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive5.181.161.44 · Confirmed phishing host address (DomainSpoof, 48 hours)TILDA-IE-1 (AS205282) · AEchecked 2026-10-19 23:10 UTC | 1 source · 1 record | Details |
amazonaspe[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours)SPF · Confirmed phishing host address (DomainSpoof, 48 hours)DMARC · checked 2026-10-19mail at amazonaspe.com · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive23.83.135.201 · Confirmed phishing host address (DomainSpoof, 48 hours)LEASEWEB-USA-PHX (AS19148) · USserver.peruvianwebpages.comchecked 2026-10-19 23:10 UTC | 1 source · 1 record | Details |
amazoncapitalsinvests[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours)SPF · Confirmed phishing host address (DomainSpoof, 48 hours)DMARC · checked 2026-10-19mail at amazoncapitalsinvests.com · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive198.251.84.200 · Confirmed phishing host address (DomainSpoof, 48 hours)PONYNET (AS53667) · USc3.my-control-panel.comchecked 2026-10-19 23:10 UTC | 1 source · 1 record | Details |
amazonepublishinghub[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Zoho (consumer mailbox) · DMARC policy none (monitor only) · sends via MailBaby, Zoho | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.48.12CloudflareCloudflare (AS13335) · US172.67.175.181CloudflareCloudflare (AS13335) · US2606:4700:3030::6815:300cCloudflareCloudflare (AS13335) · US2606:4700:3037::ac43:afb5CloudflareCloudflare (AS13335) · USchecked 2026-10-19 23:10 UTC | 1 source · 1 record | Details |
amazonepublishingpro[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours)DMARC · checked 2026-10-19mail at mail.amazonepublishingpro.com · DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive85.121.178.132ALEXHOST (AS200019) · MDchecked 2026-10-19 23:10 UTC | 1 source · 1 record | Details |
amazoninkpublishing[.]comMail: MXSPF · checked 2026-10-19mail at Zoho (consumer mailbox) · sends via dc-8e814c8572._spfm.amazoninkpublishing.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive107.180.116.255 · Confirmed phishing host address (DomainSpoof, 48 hours)GoDaddyGoDaddy (AS398101) · US255.116.180.107.host.secureserver.netchecked 2026-10-19 23:10 UTC | 1 source · 1 record | Details |
amazontoken[.]coMail: MXSPFDMARC · checked 2026-10-19mail at GoDaddy (web / mail hosting) · DMARC policy quarantine · sends via GoDaddy | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive192.124.249.40SUCURI-SEC (AS30148) · UScloudproxy10040.sucuri.netchecked 2026-10-19 23:10 UTC | 1 source · 1 record | Details |
amazon[.]biowikiweb[.]comMail: MX · checked 2026-10-19mail at mail.biowikiweb.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive103.195.103.203 · Confirmed phishing host address (DomainSpoof, 48 hours)RELIABLESITE (AS23470) · USdcp75.webpark.xyzchecked 2026-10-19 23:10 UTC | 1 source · 1 record | Details |
cipamazonas[.]org[.]peMail: MXSPFDMARC · checked 2026-10-19mail at mx2.us.opalstack.com · DMARC policy none (monitor only) · sends via spf.opalstack.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostnameBrand name inside a longer word | 2026-10-20Observed in feed | Alive23.108.108.200 · Confirmed phishing host address (DomainSpoof, 48 hours)LEASEWEB-USA-SFO (AS7203) · USopal3.opalstack.comchecked 2026-10-19 23:00 UTC | 1 source · 1 record | Details |
amazon[.]discoveryloft[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Google (consumer mailbox) · DMARC policy none (monitor only) · sends via Google, 20780504.spf10.hubspotemail.net | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive172.253.122.121GoogleGoogle (AS15169) · USbh-in-f121.1e100.net2607:f8b0:4004:c09::79GoogleGoogle (AS15169) · USbh-in-f121.1e100.netchecked 2026-10-19 23:10 UTC | 1 source · 1 record | Details |
dosselamazonia[.]org[.]brMail: MX · checked 2026-10-19mail at Google (consumer mailbox) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostnameBrand name inside a longer word | 2026-10-20Observed in feed | Alive199.36.158.100FastlyFastly (AS54113) · USchecked 2026-10-19 23:00 UTC | 1 source · 1 record | Details |
iniciamazon[.]com[.]brMail: MXSPFDMARC · checked 2026-10-19mail at mxa.api-mail.com · DMARC policy none (monitor only) · sends via api-mail.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.63.146CloudflareCloudflare (AS13335) · US172.67.146.220CloudflareCloudflare (AS13335) · US2606:4700:3030::6815:3f92CloudflareCloudflare (AS13335) · US2606:4700:3037::ac43:92dcCloudflareCloudflare (AS13335) · USchecked 2026-10-19 23:00 UTC | 1 source · 1 record | Details |
institutoamazonico[.]edu[.]peMail: MXSPF · Confirmed phishing host address (DomainSpoof, 48 hours) · checked 2026-10-19mail at Google (consumer mailbox) · sends via Google | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostnameBrand name inside a longer word | 2026-10-20Observed in feed | Alive170.249.206.98 · Confirmed phishing host address (DomainSpoof, 48 hours)PRIVATESYSTEMS (AS63410) · UShost2.institutoamazonico.edu.pechecked 2026-10-19 23:00 UTC | 1 source · 1 record | Details |
amazon-clone-f73c[.]panda[.]newMail: MXSPFDMARC · checked 2026-10-19mail at Google (consumer mailbox) · DMARC policy quarantine · sends via spf.tapfiliate.com, Google | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive66.33.60.67Amazon Web ServicesAmazon Web Services (AS16509) · US76.76.21.98Amazon Web ServicesAmazon Web Services (AS16509) · USchecked 2026-10-19 23:10 UTC | 1 source · 1 record | Details |
amazon[.]sevendaygroup[.]comMail: MXSPF · checked 2026-10-19mail at Proofpoint Essentials (mail security gateway) · sends via Proofpoint Essentials, GoDaddy | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-19 22:05 UTC | 1 source · 1 record | Details |
authorize[.]ahomeintheamazon[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours), Emerging Threats open block list, Spamhaus DROP (credit: The Spamhaus Project) · checked 2026-10-19mail at ahomeintheamazon.com | Listed by PhishDestroyAbsent from latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | SERVFAILchecked 2026-10-20 01:05 UTC | 1 source · 1 record | Details |
16 registrable domains · 16 hostnames · page 1 of 1
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.