As Amazon prepares for Prime Big Deal Days, its Fall Prime Day event on October 6-7, cybercriminals are already exploiting the anticipation surrounding one of the year’s largest online shopping events. New findings from Check Point Research reveal a significant increase in Amazon-related domains, alongside ongoing phishing campaigns and malicious websites designed to target online shoppers.
Amazon-Related Domain Registrations Continue to Rise
Check Point Research observed a steady increase in newly registered Amazon- and Prime Day-related domains in the months leading up to the event. New Amazon- and Prime Day-related domain registrations have risen for three straight months, climbing from 905 in July 2026 to 1,284 in September 2026—an increase of 42%. That September figure is also up 37% year-over-year compared to September 2025 (937 domains), pointing to accelerating registration activity as Fall Prime Day approaches.
In September 2026, 6.5% of newly registered Amazon- and Prime Day-related domains were classified as malicious or suspicious by Check Point ThreatCloud—one in every 16 new domains—confirming that threat activity around the Amazon brand is active well ahead of Fall Prime Day.
Malicious Infrastructure Leveraging the Amazon Brand
Representative malicious domains registered between July and September 2026, specifically targeting the Amazon Prime brand, and classified as malicious by Check Point ThreatCloud AI included:
- amazonprime-support[.]com
- primevideoamazon[.]com
- videoamazonprime[.]com
- prime-amazonfr[.]com
- amazonprimeusa[.]com
- amazonprimewindows[.]com
In addition, many fake Amazon login pages targeting users in multiple countries, including Japan, Vietnam and the United Kingdom have been identified, as can be seen in the examples below. The ultimate goal of these attacks is the theft of Amazon credentials, payment information and personal data.
Check Point Research also characterized coordinated malicious infrastructure campaigns. One cluster, dubbed the AmazonShopping/ShoppingOnAmazon Numbered Network, consisted of eleven related domains, ten of which were classified as malicious. The infrastructure is likely designed to imitate online storefronts and checkout processes in order to harvest credentials and payment information. A second campaign, referred to as the AmazonGlobal Numbered Domains, included five similarly structured domains targeting international shoppers, all of which were identified as malicious. Some further examples found include full fake Amazon storefront websites from Germany and Japan, and even a website targeting the delivery partners program in India. This shows the vast diversity of the targeted audience around Amazon and Prime Day.
Phishing Campaigns Targeting Prime Day Shoppers
Beyond malicious domains, researchers observed phishing emails impersonating Amazon communications and services during September 2026, which were blocked by Check Point Email Security. Examples included fraudulent emails using messages such as claims for free gift cards or alerts that the user’s account has been locked.
These campaigns attempt to create urgency and encourage recipients to click malicious links or submit personal information. Other campaigns may also involve malware disguised as invoices, delivery notifications or refund-related communications.
The growing use of generative AI is also making these scams harder to spot. AI tools allow threat actors to quickly produce well-written, localized phishing messages and convincing replica websites at scale, removing many of the traditional warning signs, such as spelling mistakes or awkward phrasing, that shoppers have long relied on to identify fraud.
Cybercriminals Continue to Capitalize on Major Shopping Events
Fall Prime Day, also marketed as October Prime Day or Prime Big Deal Days, runs October 6–7, 2026, delivering Amazon’s second major discount event of the year globally. The event compresses a huge volume of consumer purchases, gift-card redemptions and account logins into a 48-hour window, making it a recurring flashpoint for financially motivated cyber activity worldwide. It also pushes an enormous volume of online payments through banking and financial transaction processing platforms while retailers ramp up storefronts to handle the surge — conditions that historically translate into elevated attack pressure against these sectors.
Cyber attacks against Financial Services organizations — the banking and payments infrastructure that clears Prime Day purchases — has been climbing steadily across the run-up to the event, reaching 2,650 average weekly attacks per organization in September 2026, an increase of 14% from August and 66% year-over-year. That year-over-year increase far outpaces the 48% rise seen across all industries globally over the same period, intensifying the risk around these services ahead of the October sale. The monthly trend also shows the sustained build-up in attack activity across the sector, with a steady increase since May 2026 and a major jump in September.
In addition, as the retailers, marketplaces, and electronics sellers actually running the Fall Prime Day sale, Consumer Goods & Services organizations recorded 2,578 average weekly attacks per organization in September 2026 — a significant increase of 22% month-over-month and 52% year-over-year.
As major retail events attract millions of consumers and generate significant online transaction volumes, cybercriminals continue to exploit increased digital engagement through brand impersonation, phishing campaigns and fraudulent websites. For retailers, payment providers and financial institutions, this reinforces the importance of identifying and blocking malicious domains and phishing attempts before they reach customers, rather than responding once the damage has been done.
How to Shop Safely During Prime Day
Check Point Research recommends taking the following precautions during Prime Day and other seasonal shopping events:
- Access Amazon directly through the official website or mobile application.
- Avoid clicking links contained in unsolicited emails, text messages or social media advertisements.
- Verify website URLs carefully before entering credentials or payment information.
- Enable multi-factor authentication whenever available.
- Be cautious of offers that create urgency or appear unusually attractive.
- Do not rely on spelling or grammar mistakes alone to detect scams, as AI-generated messages and websites can look polished and professional.
- Monitor payment card and banking activity after online purchases.
Prime Day Threat Activity Is Already Underway
Prime Day remains one of the world’s largest online shopping events, but it is also an increasingly attractive opportunity for cybercriminals. With malicious Amazon-themed domains continuing to emerge and phishing campaigns already active ahead of the October event, consumers should remain vigilant and verify the legitimacy of communications, websites and offers before taking action. As shopping activity increases, combining user awareness with a prevention-first approach, stopping threats before they can reach shoppers, remains one of the most effective defenses against fraud, credential theft and online scams.
