Amazon phishing page reported on vn-bia66.net
An X user flagged an Amazon Japan phishing page on 2c64b8e9.vn-bia66.net that redirects to 9k999.site. vn-bia66.net is not an Amazon domain; Amazon is not involved.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 7 November 2026 an X user posted screenshots of an Amazon-themed phishing site reached via hXXps://2c64b8e9[.]vn-bia66[.]net/6ac2a7dc, noting that it redirected toward hXXps://f4f0d8[.]9k999[.]site/. The post, tagged #詐欺メール (scam email) and #Amazon, said the URLs had been defanged and were shared in good faith. Another vn-bia66.net subdomain (e7e29fe7.vn-bia66.net) appears on the Phishing Army blocklist. vn-bia66.net is not an Amazon domain, and Amazon is not involved.
How the scam works
The screenshot shows a copy of the Japanese Amazon sign-in page with the amazon.co.jp logo, a heading asking the visitor to sign in or create an account, a field for a mobile number or email address and a yellow Continue button, with the real address 2c64b8e9.vn-bia66.net visible at the bottom of the browser. Copying the first step of the real login, then asking for the password and often card details on later screens, makes the page feel genuine.
The hashtag suggests the link arrived in a scam email. Amazon phishing emails in Japan commonly claim that an account has been locked, a payment method has expired or an order needs confirming. Random subdomains such as 2c64b8e9 and a chain of redirects to other hosts like 9k999.site let operators rotate addresses quickly, so blocking one address does not stop the campaign, which is why a different subdomain of the same base domain already appears on a blocklist.
Amazon account problems can be checked by opening the official Amazon app or typing amazon.co.jp yourself. Anyone who entered details on this page should change their Amazon password, review the payment methods and addresses saved in the account, enable two-step verification and contact their card company if card numbers were entered. The details come from the X post and have not been independently checked by scammers.com.
Source
Post on X by @delicious_unaju, 7 November 2026, flagging 2c64b8e9.vn-bia66.net. Not independently verified by scammers.com.
Red flags
- An Amazon login page on an address that is not amazon.co.jp or amazon.com.
- A random-looking subdomain such as 2c64b8e9.vn-bia66.net.
- An email saying your account is locked or payment details must be updated.
- A sign-in link that redirects through several unrelated domains.
If you were targeted
- 1Do not enter passwords, card numbers or one-time codes on a page reached from a text, email or ad.
- 2Open the company's official app or type its address yourself to check your account.
- 3If you entered details, change your password at once and contact the company through its official channels.
- 4Report the message and the link to the company and to your national phishing reporting service.
- 5Delete the message without replying or tapping any links.