Amazon login URL: the real address
Amazon's real sign-in page is on www.amazon.com. If a link takes you anywhere else and asks for your Amazon password, close it. We opened each address below on 9 November 2026.
Sign-in is at www.amazon.com/ap/signin, or the same path on your country's store (amazon.co.uk, amazon.de, amazon.in and so on)
Domains Amazon uses
Not a complete list. Each address below can have subdomains in front of it (www., login.), and they are still Amazon's.
amazon.comamazon.co.ukamazon.deamazon.inamazon.caamazon.com.au
Real Amazon domains where anyone can publish
These belong to Amazon, but the pages on them are made by its customers. A sign-in form here is not Amazon's sign-in page.
| Address | Why | Live phishing URLs |
|---|---|---|
amazonaws. | Amazon Web Services is a cloud anyone can rent. A page on amazonaws.com is a customer's page, not Amazon's store. | 73 |
awstrack. | Click-tracking links from Amazon's email service, which any AWS customer can send. | 22 |
Live phishing URLs: any brand, counted in PhishTank's list on 5 November 2026.
How to read the address
Look at the part between https:// and the first single /. Read it from the right. The real thing ends in amazon.com or another domain listed below, with nothing but a dot before it.
https://login.amazon.com/…is Amazon: it ends in.amazon.com.https://amazon.com.account-check.example/…is not: it ends inaccount-check.example, and Amazon's name at the front is decoration.https://amazon-secure-login.example/…is not: a hyphen makes a different domain, and anyone can register one.
Everything after the first / is chosen by whoever made the page, so …/amazon.com/signin in the path proves nothing.
What fake Amazon pages looked like
On 5 November 2026, PhishTank listed 356 live, verified phishing URLs that its volunteers labelled Amazon.
- 94.1% used HTTPS. The padlock means the connection is encrypted, not that the site is Amazon.
- 2.2% had "amazon" in the hostname. Most fakes give no such clue, so the absence of Amazon's name doesn't make a link safe either.
- 10.7% sat on services anyone can sign up to, such as website builders, file sharing and QR-code links, rather than on a domain the attacker registered.
Hostnames from the same list that use Amazon's name without being Amazon's, newest first. Dots are written as [.] so none of them is a working link.
- amazoncheckout[.]netlify[.]app
- amazon-video-musique[.]com
- primevideoamazon[.]myminfin-idaccount[.]org
- amazon-paiement[.]com
- amazon-refund[.]cc
- amazonwebservices[.]security-unauthorised-request[.]com
Report a fake Amazon email or page
Follow the steps on Amazon's own Report a scam help page. We could not open that page to confirm its current email address, so we don't print one here.
Source: Amazon: Report a scam, checked 9 November 2026.
Lures to watch for
- Amazon's real sign-in is always on your country's Amazon store domain. amazonaws.com is a different business: Amazon's rented cloud servers.
- Fake "order problem" or "account on hold" messages are the usual lures. Open the Amazon app or type the store address and check Your Orders.
Not sure about a link? Paste it into the free link checker. It reads the address only and doesn't open the page. The PhishClean browser extension also checks each page you open for signs of a fake sign-in form.
Questions
What is Amazon's official login URL?
www.amazon.com (Sign-in is at www.amazon.com/ap/signin, or the same path on your country's store (amazon.co.uk, amazon.de, amazon.in and so on)). A real Amazon address ends in amazon.com, amazon.co.uk, amazon.de or another domain the brand owns, read from the right of the hostname.
How do I report a fake Amazon email or website?
Follow the steps on Amazon's own Report a scam help page. We could not open that page to confirm its current email address, so we don't print one here.
Do fake Amazon sites use Amazon's name in the address?
In PhishTank's list of live phishing URLs on 5 November 2026, 8 of the 356 URLs labelled Amazon (2.2%) had the brand's name in the hostname, so most gave no such clue. 94.1% used HTTPS, so a padlock proves nothing.
Can a phishing page be on a real Amazon domain?
Yes. amazonaws.com, awstrack.me belong to Amazon, but the pages there are made by its customers, so a sign-in form there is not Amazon's sign-in page. PhishTank's list on 5 November 2026 held 95 live phishing URLs on these addresses.
How we checked
- Sign-in addresses: opened on 9 November 2026 and followed through every redirect to where the sign-in page loads.
- Phishing numbers: PhishTank's online-valid list, downloaded 5 November 2026. Only URLs its volunteers labelled Amazon count, and many fakes are labelled "Other", so these are a sample. We didn't open any of them. Data shared under CC BY-SA 2.5; method as in our phishing URL statistics.
- Example hostnames: hostnames in the whole list that contain "amazon" but aren't on Amazon's domains, one per domain.
See also: official sign-in addresses of 15 brands.
Last updated: , when the sign-in addresses were checked.