Researchers have warned that almost 7,000 counterfeit Amazon domains have been registered in anticipation of Prime Day 2026.

      TL;DR Check Point discovered 6,843 counterfeit Amazon domains prior to Prime Day, with phishing emails and fake storefronts targeting consumers in 22 countries. Cybersecurity experts reported almost 7,000 fraudulent Amazon-related domains registered in the six months leading up to Prime Day 2026, starting on June 23. Check Point Research tracked 6,843 new domains created from December 2025 to May 2026, with a peak of 1,446 registrations in April and 1,267 in May.

      Of these, 9.2 percent were identified as malicious or suspicious. The rate sharply increased in early June, with one in every 13 new Amazon-themed domains flagged in the first week of the month, according to Check Point’s analysis.

      Prime Day 2026 is scheduled from June 23 to 26 across 22 countries, with four additional markets joining later in the summer, as stated on Amazon’s official event page. The four-day event and its global scope make it a high-value target for phishing schemes, similar to patterns observed during the FIFA World Cup, which saw over 13,000 fraudulent domains emerge in the months prior.

      The phishing operations include fake Amazon storefronts aimed at collecting credit card information, spoofed login pages to steal account credentials, and email campaigns with subject lines like “Refund Due, Amazon System Error” that lead recipients to counterfeit websites. Check Point highlighted one campaign that used a sender address closely resembling Amazon’s customer service domain, allowing it to evade casual scrutiny.

      A significant number of domains targeted Spanish-speaking shoppers. Check Point found 46 domains registered under the “amazoncredito” pattern, all linked to a single registrant and focusing on Latin American markets where Amazon is expanding its Prime membership. At the time of the report, five of six “amazon-prime” top-level domain variants had already been labeled as malicious.

      While these tactics are not new, their scale is increasing. Google recently sued a Chinese cybercrime ring that employed AI to create phishing code and operated one million fraudulent domains, highlighting the ease and automation of domain-based fraud. Check Point’s findings suggest that operations related to Amazon follow a similar industrial trend, with thousands of domains registered months in advance and activated as shopping events approach.

      Check Point recommended that shoppers enter amazon.com directly into their browser instead of clicking on links in emails or advertisements, enable two-factor authentication on their Amazon accounts, and be cautious of any unsolicited refund notifications. The company also advised checking for HTTPS and padlock icons, although it noted that fraudulent sites are increasingly using valid SSL certificates to seem legitimate.

      The significance of the timing lies in the fact that Prime Day has evolved into one of the largest online shopping events worldwide, generating billions in revenue and attracting millions of first-time deal seekers who may be less aware of phishing strategies. Amazon has not publicly addressed Check Point’s findings.