Metemcyber flagged an Amazon Japan phishing page at aniv.dqtjvxa.cn/ap/ on 43.165.128.22. Amazon is not involved.
Source: x.com · published
On 9 November 2026 the phishing tracker @Metemcyber (crediting Team NA4Sec) posted on X that aniv.dqtjvxa.cn was hosting a phishing page impersonating Amazon. The post described an Amazon-branded page aimed at users in Japan at the path /ap/, hosted on IP 43.165.128.22 (AS132203). The domain is not operated by Amazon, and Amazon is not involved.
Phishing pages like this are usually reached through a text message, email or search ad that claims there is a problem with an account, a payment or a delivery. The link opens a copy of the Amazon sign-in or checkout screen on an address that has nothing to do with Amazon. Anything typed into the form goes to whoever runs the page.
Criminals then use stolen logins to take over accounts, place orders or try the same password on other services, and card details can be used within minutes. Because the page can look almost identical to the real one, the safest check is the address bar: aniv.dqtjvxa.cn is not a Amazon address.
Open Amazon only through the Amazon app or by typing amazon.co.jp yourself. Anyone who entered details on aniv.dqtjvxa.cn should change the password through the official Amazon app or website, enable two-step verification and contact their card issuer if payment details were entered. The indicators come from the post and have not been independently checked by scammers.com.
Amazon account problems should be checked only in the official Amazon app or by typing amazon.co.jp yourself. A Chinese .cn hostname with an Amazon-looking path is a strong sign the page is not Amazon.
Post by @Metemcyber on X, 9 November 2026, flagging aniv.dqtjvxa.cn. Not independently verified by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 three Weebly-hosted pages it flagged as phishing: zimbfree[.]weebly[.]com, zimbrafree9[.]weebly[.]com and zim-update2025[.]weebly[.]com. Its records describe Zimbra-…
URL-analysis service urlDNA (@urldna@infosec.exchange) posted on Mastodon on 12 November 2026 that hxxps://rdkyle[.]wixsite[.]com/my-site is possible phishing. The screenshot it captured shows a Wix-built page reading…