Brand Impersonation Evidence: Amazon

Lookalike domains are impersonating Amazon

This is a public evidence page from Scam Detective’s published research. The real Amazon operates at amazon.com. The 3 domains below impersonate it — each with the corroborated evidence. Nothing here is a guess: every finding is backed by the independent sources listed further down the page.

Lookalike domains found

Critical

Overall risk level

Independent corroborating sources

October 17, 2026

Case verified

The evidence

Confirmed lookalike domains

High riskLookalike sender domain — fake “account security” phishing email

amazon-security.com

Registration profileLookalike sender domains registered to mimic amazon.com mail — rotated as they accumulate reports

First seenDocumented across the 2025–2026 fake order-alert and account-suspension phishing waves

Evidence

Real Amazon emails come from addresses ending in @amazon.com or @marketplace.amazon.com — this lookalike exists purely to pass a glance at the sender field.
Links point to cloned Amazon login pages that harvest credentials and payment data.
The email insists you click to “verify”, “confirm”, or “cancel” something — real Amazon order and account issues are always visible by logging into amazon.com directly.

High riskLookalike sender domain — fake “billing” phishing email

amazon-billing.net

Registration profileSame lookalike-sender rotation on an alternate TLD — interchangeable names for the same campaign

First seenDocumented across the 2025–2026 fake order-alert and account-suspension phishing waves

Evidence

“Billing” variant of the same sender lookalike — targets payment anxiety with fake charge notifications.
Same credential-harvesting login-page payload behind the link.

High riskLookalike sender domain — fake “order alert” phishing email

amazon-orders.co

Registration profileSame lookalike-sender rotation — alternate TLD, same campaign

First seenDocumented across the 2025–2026 fake order-alert and account-suspension phishing waves

Evidence

“Orders” variant using an alternate TLD — the same trick with a different extension.
Fake order-alert framing: an order you don't recognize, urging a click to “cancel” it before you check your real account.

Pattern watchlist — not yet independently confirmed

amazon-support.com — Fake support-site variant documented in the same campaign family — the operation rotates sender and landing-domain names as each is reported.

amazon-security-alert.net — Alternate-extension rotation of the same “security alert” lookalike.

Red flags in this impersonation

01The sender domain isn't amazon.com — check the full address, not the display name, which is trivially forged.

02Urgency and threats — “your account will be closed in 24 hours” is a hallmark of the scam, not of real Amazon communication.

03Links to anything other than amazon.com — hover before clicking; a long URL with random characters is a phishing link.

04Amazon will never call you asking for your password, full card number, or a one-time verification code.

05The message isn't visible in your account — real order and account notifications are always there when you log in to amazon.com directly.

06Lookalike TLD rotations (.net, .co) of official-sounding names — the extension is part of the disguise.

Who corroborates this evidence

Amazon's own anti-phishing channel

Amazon operates a dedicated phishing-reporting address, [email protected], precisely because these impersonation campaigns target its customers at scale — the company's own reporting infrastructure confirms the pattern.

Scam Detective's published investigations

Two dedicated investigations of Amazon impersonation (fake order alerts, fake support calls, and phishing emails) documented the lookalike sender domains and cloned login pages.

Pattern match to corroborated cases on this site

The same lookalike-sender and cloned-page playbook is documented across our corroborated brand cases — StoneX (the brand's own fraud warning), USPS (USPS and FCC warnings), and Fidelity (Ghana SEC warning).

We found this without being asked

A brand impersonation audit does the same sweep for your company: every lookalike domain, typosquat, and copycat store impersonating your brand — each with evidence and a risk rating, plus a ready-to-send takedown-request template. Delivered instantly, $29 one-time, no subscription.

Audit my brand — $29

Get the free Amazon impersonation evidence pack

Every confirmed lookalike domain, the red-flag pattern, and the independent corroboration from this page — compiled into one file and emailed to you, free. Useful for your security or legal team even if you never buy anything from us.

Ready now? The brand impersonation audit sweeps your own company for every lookalike domain, typosquat, and copycat store — with evidence, risk ratings, and a takedown-request template. $29 one-time, delivered instantly, no subscription.