phishunt.io flags amazon.cgiagent.com Amazon phishing site
phishunt.io flagged amazon.cgiagent.com as an Amazon phishing site on 72.47.208.142. The hostname is not operated by Amazon.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 6 November 2026 the phishing tracker phishunt.io posted on X that amazon.cgiagent.com was hosting a phishing page impersonating Amazon. The post said the hostname resolves to 72.47.208.142 on GoDaddy's network (AS398101) in the United States and linked to phishunt.io's Amazon listing. The domain also appears on the Phishing Army blocklist. Putting the word amazon at the start of someone else's domain is a common trick, because the real owner of the address is cgiagent.com. The domain is not operated by Amazon, and Amazon is not involved in the page.
How the scam works
Phishing pages like this are usually reached through a text message, email or search ad that claims there is a problem with an account, an order or a payment. The link opens a copy of the Amazon sign-in or checkout screen on an address that has nothing to do with Amazon. Anything typed into the form, such as an email address, password, card number or one-time code, goes to whoever runs the page rather than to Amazon.
Criminals then use the stolen login to take over the account, place orders, change the recovery email or try the same password on other services. Card details can be used for fraudulent purchases within minutes. Because the page can look almost identical to the real one, the safest check is the address bar: amazon.cgiagent.com is not a Amazon address. Public blocklists and tracker feeds such as the one that flagged this site help browsers and security tools warn visitors, but a newly created page can stay online for some time before every filter catches it.
Anyone who entered details on amazon.cgiagent.com should change the password through the official Amazon app or website straight away, sign out other sessions, turn on two-step verification and contact their card issuer if payment details were entered. The indicators come from the tracker's post and have not been independently checked by scammers.com.
Source
Post by phishunt.io (@phishunt_io) on X, 6 November 2026, flagging amazon.cgiagent.com. Not independently verified by scammers.com.
Red flags
- A Amazon login or payment page on an address that is not an official Amazon domain.
- A link to amazon.cgiagent.com arriving by text, email or ad.
- A message that creates urgency about an account problem, order or payment.
- A request for your password, card number or one-time code after following a link.
- A hostname that begins with amazon but ends with an unrelated domain such as cgiagent.com.
If you were targeted
- 1Do not enter passwords, card numbers or one-time codes on a page reached from a text, email or ad.
- 2Open the company's official app or type its address yourself to check your account.
- 3If you entered details, change your password at once and contact the company through its official channels.
- 4Report the message and the link to the company and to your national phishing reporting service.
- 5Delete the message without replying or tapping any links.