Today, I recieved a message that purports to be from Amazon. Screenshot Normally, I can spot a phishing email from a distance. (I work in an ISP's Abuse & NOC department.) But this one seems just slightly off. If it is phishing, it's scary good.

The one hint I have that it's not real is that it was sent to an address of {the A in Q&A}@eoni.com, which doesn't have a Kenneth (it's a tech support address for our ISP that also does domain hosting). The fact that they are using that address makes me think the address could have been automatically collected (whois probably). It is quite possible that one of the domains we host is for a customer named Kenneth, and that that domain has our contact address on the whois record somewhere. We have enough domains hosted that just a first name is not going to be enough to find said domain name and look at the whois record.

Being in the abuse department, I wanted to know if this is real or not (so I can report it if not/possibly block it from working on our network if it is a Phish).

Here's the headers:

Return-Path: <01010157e278aa63-283a615a-b603-4300-8c6f-8426b3978f81-000000@us-west-2.amazonses.com>
Delivered-To: {a in Q&A}@eoni.com
Received: (qmail 8542 invoked from network); 20 Oct 2016 14:22:22 -0000
Received: from a27-163.smtp-out.us-west-2.amazonses.com (HELO a27-163.smtp-out.us-west-2.amazonses.com) (
    by adam6.eoni.com with (AES128-SHA encrypted) SMTP
    (9d6af486-96d0-11e6-bacc-001e67492cec); Thu, 20 Oct 2016 07:22:22 -0700
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
    s=iapqtturmhylirl6i5t3a2ps2ewsadsl; d=business.amazon.com;
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
    s=gdwg2y3kokkkj5a55z2ilkup5wp5hhxx; d=amazonses.com; t=1476973341;
Message-ID: <01010157e278aa63-283a615a-b603-4300-8c6f-8426b3978f81-000000@us-west-2.amazonses.com>
Date: Thu, 20 Oct 2016 14:22:21 +0000
Subject: Free Upgrade to Amazon Business Account
From: Amazon <[email protected]>
To: {A in Q&A}@eoni.com
MIME-Version: 1.0
Content-Type: multipart/alternative;
X-Pardot-Route: 113:54552:359489270
List-Unsubscribe: <http://www.amazonbusiness.com/unsubscribe/u/54552/6674f6c0dd8377b4a26688a664718cffd707396fd788791d186acab4a81bd210/359489270>
X-Report-Abuse-To: [email protected]
X-SES-Outgoing: 2016.10.20-
Feedback-ID: 1.us-west-2.DslCQSzKRwSQ0bYxCfi+GcY39H31l7QrR+kFUIOTrc4=:AmazonSES
X-MagicMail-OS: Inactive
X-MagicMail-UUID: 9d6af486-96d0-11e6-bacc-001e67492cec
X-MagicMail-RegexMatch: 0
X-MagicMail-EnvelopeFrom: <01010157e278aa63-283a615a-b603-4300-8c6f-8426b3978f81-000000@us-west-2.amazonses.com>
X-MagicMail-Original-Destination: {A in Q&A}@eoni.com
X-MagicMail-Quarantine: Yes

Looking at the headers, I see it is from what I believe is an AWS email service. (Anyone can buy that and send email). So that doesn't convince me it's Amazon. I see stuff about about Pardot, a salesforce B2B Marketing automation system. That seems odd that it wouldn't be in house to Amazon, but they could use a system like that. So not sure what to think on that.

If this is an attack, it has to work somehow. Where do the links go?

Create my account: http:/www.amazonbusiness.com/e/54552/gistration-start-ref-b2b-e459b/jt2hvr/359489270

Unsubscribe: http:/www.amazonbusiness.com/preferences/?ehash=6674f6c0dd8377b4a26688a664718cffd707396fd788791d186acab4a81bd210&email_id=359489270

Update email preferences: http:/www.amazonbusiness.com/preferences/?ehash=6674f6c0dd8377b4a26688a664718cffd707396fd788791d186acab4a81bd210&email_id=359489270

None of these have SSL, but the Create my account one redirects to:


Ok, where is this amazonbusiness.com domain hosted? Who owns the name? Surely Amazon would host all of their sites on AWS, right?

dig a  www.amazonbusiness.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> a www.amazonbusiness.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58074
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0

;www.amazonbusiness.com.        IN  A

www.amazonbusiness.com. 820 IN  CNAME   go.pardot.com.
go.pardot.com.      7199    IN  CNAME   pi.pardot.com.
pi.pardot.com.      29  IN  CNAME   pi-dfw.pardot.com.
pi-dfw.pardot.com.  29  IN  CNAME   pi-dfw-lb1.pardot.com.
pi-dfw-lb1.pardot.com.  899 IN  A

;; Query time: 57 msec
;; WHEN: Thu Oct 20 08:21:50 PDT 2016
;; MSG SIZE  rcvd: 143

Compare that to amazon.com itself:

dig a amazon.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> a amazon.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40326
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0

;amazon.com.            IN  A

amazon.com.     23  IN  A
amazon.com.     23  IN  A
amazon.com.     23  IN  A
amazon.com.     23  IN  A
amazon.com.     23  IN  A
amazon.com.     23  IN  A

;; Query time: 1 msec
;; WHEN: Thu Oct 20 09:02:34 PDT 2016
;; MSG SIZE  rcvd: 124

Ok, so who owns the IP address space for the possibly fake site:


# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/whoisinaccuracy/index.xhtml

# The following results may also be obtained via:
# https://whois.arin.net/rest/nets;q=

NetRange: -
NetName:        SFDC-3
NetHandle:      NET-136-147-0-0-1
Parent:         NET136 (NET-136-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       AS14340
Organization:   Salesforce.com, Inc. (SALESF-3)
RegDate:        2012-02-24
Updated:        2014-07-14
Ref:            https://whois.arin.net/rest/net/NET-136-147-0-0-1

OrgName:        Salesforce.com, Inc.
OrgId:          SALESF-3
Address:        1 Market Street
Address:        Suite 300
City:           San Francisco
StateProv:      CA
PostalCode:     94105
Country:        US
RegDate:        1999-11-30
Updated:        2014-11-20
Ref:            https://whois.arin.net/rest/org/SALESF-3

OrgAbuseHandle: NOC1403-ARIN
OrgAbuseName:   Network Operations Center
OrgAbusePhone:  +1-415-901-7000 
OrgAbuseEmail:  [email protected]
OrgAbuseRef:    https://whois.arin.net/rest/poc/NOC1403-ARIN

OrgNOCHandle: NOC1403-ARIN
OrgNOCName:   Network Operations Center
OrgNOCPhone:  +1-415-901-7000 
OrgNOCEmail:  [email protected]
OrgNOCRef:    https://whois.arin.net/rest/poc/NOC1403-ARIN

OrgAbuseHandle: SAN76-ARIN
OrgAbuseName:   Salesforce Abuse NOC
OrgAbusePhone:  +1-703-463-3219 
OrgAbuseEmail:  [email protected]
OrgAbuseRef:    https://whois.arin.net/rest/poc/SAN76-ARIN

OrgTechHandle: NOC1403-ARIN
OrgTechName:   Network Operations Center
OrgTechPhone:  +1-415-901-7000 
OrgTechEmail:  [email protected]
OrgTechRef:    https://whois.arin.net/rest/poc/NOC1403-ARIN

RNOCHandle: NOC1403-ARIN
RNOCName:   Network Operations Center
RNOCPhone:  +1-415-901-7000 
RNOCEmail:  [email protected]
RNOCRef:    https://whois.arin.net/rest/poc/NOC1403-ARIN

RAbuseHandle: SAN76-ARIN
RAbuseName:   Salesforce Abuse NOC
RAbusePhone:  +1-703-463-3219 
RAbuseEmail:  [email protected]
RAbuseRef:    https://whois.arin.net/rest/poc/SAN76-ARIN

RTechHandle: NOC1403-ARIN
RTechName:   Network Operations Center
RTechPhone:  +1-415-901-7000 
RTechEmail:  [email protected]
RTechRef:    https://whois.arin.net/rest/poc/NOC1403-ARIN

# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/whoisinaccuracy/index.xhtml

So NOT on AWS. Compare to who owns the IP address space hosting Amazon.com:


# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/whoisinaccuracy/index.xhtml

# The following results may also be obtained via:
# https://whois.arin.net/rest/nets;q=

NetRange: -
NetName:        AMAZON-2011L
NetHandle:      NET-54-224-0-0-1
Parent:         NET54 (NET-54-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       AS16509
Organization:   Amazon Technologies Inc. (AT-88-Z)
RegDate:        2012-03-01
Updated:        2012-04-02
Ref:            https://whois.arin.net/rest/net/NET-54-224-0-0-1

OrgName:        Amazon Technologies Inc.
OrgId:          AT-88-Z
Address:        410 Terry Ave N.
City:           Seattle
StateProv:      WA
PostalCode:     98109
Country:        US
RegDate:        2011-12-08
Updated:        2014-10-20
Comment:        All abuse reports MUST include:
Comment:        * src IP
Comment:        * dest IP (your IP)
Comment:        * dest port
Comment:        * Accurate date/timestamp and timezone of activity
Comment:        * Intensity/frequency (short log extracts)
Comment:        * Your contact details (phone and email) Without these we will be unable to identify the correct owner of the IP address at that point in time.
Ref:            https://whois.arin.net/rest/org/AT-88-Z

OrgTechHandle: ANO24-ARIN
OrgTechName:   Amazon EC2 Network Operations
OrgTechPhone:  +1-206-266-4064 
OrgTechEmail:  [email protected]
OrgTechRef:    https://whois.arin.net/rest/poc/ANO24-ARIN

OrgAbuseHandle: AEA8-ARIN
OrgAbuseName:   Amazon EC2 Abuse
OrgAbusePhone:  +1-206-266-4064 
OrgAbuseEmail:  [email protected]
OrgAbuseRef:    https://whois.arin.net/rest/poc/AEA8-ARIN

OrgNOCName:   Amazon AWS Network Operations
OrgNOCPhone:  +1-206-266-4064 
OrgNOCEmail:  [email protected]
OrgNOCRef:    https://whois.arin.net/rest/poc/AANO1-ARIN

# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/whoisinaccuracy/index.xhtml

So Amazon.com is on AWS, just like I thought it would be.

At this point, I'm not sure whether the email is fake or not. Is it? If so, how does it work? It seems to be doing something with OpenID, what's going on there? How could I know for sure in the future?

  • 4
    It's not a phish. Amazon uses SalesForce for marketing campaigns, as do most other large companies. The NSes are the same as Amazon.com. The registrar is MarkMonitor, which is not your run of the mill any-domain-for-ten-bucks registrar, and the same used for Amazon.com. I don't see anything shady about this.
    – Xander
    Commented Feb 17, 2018 at 1:10
  • business-to-business automated marketting, Salesforce Pardot: pardot.com Salesforce and Amazon's "global strategic partnership": salesforce.com/company/news-press/press-releases/2019/11/… Commented Jan 28, 2020 at 0:24
  • - Got the same mail, had same suspicious. - Liked the way you describe your little research by dig & whois. - Thanks Commented Mar 29, 2023 at 15:01

4 Answers 4


I think it is, I have just visited http://amazonbusiness.com and it 302 redirected me to https://www.amazon.com/gp/help/customer/display.html/?nodeId=508510 which is not a business page.

When I google amazon business the search result is for https://www.amazon.com/business and redirects to https://www.amazon.com/b2b/info/amazon-business?layout=landing which very much is an amazon business page.

These guys are good.

  • 1
    It is not a phish. This should be reasonably obvious.
    – Xander
    Commented Feb 17, 2018 at 1:15

Phishing; I received a nearly identical email. I was able to verify with amazon that it was not sent from them and should be treated as malicious.

The email I received was sent from "[email protected]". It had a slightly different appearance to the graphics and a different wording of the first line, but it contained the same links and routed through the same suspicious paths indicated by the op before landing on a valid amazon log on page.

I sent the email to amazon and then contacted them by phone where they were certain that it was not sent by them. Amazon stated that they keep a log of every communication. If you contact them about an email you received they can quickly verify if it was sent by them or not.

I hope this helps eliminate any question of if it is or is not phishing.

  • [email protected] is a legitimate Amazon domain, and the email is (most likely) legitimate. If you called Amazon customer service, you were talking to their consumer/retail side, not business side - and they, of course, wouldn't have a log of sending an email from their business services domain. Commented Nov 29, 2022 at 15:39

The URL amazonbusiness.com does appear to be a legitimate Amazon domain. ICANN shows the same registrant info for both that URL and for amazon.com.

In case the registration detail have been spoofed, they both have the same hostmaster phone and email. So you can ask them if it is a valid Amazon domain.

  • What keeps me from registering a domain, and then just putting the correct contact info for the person I'm trying to impersonate? Or to put it another way, why should I trust whois? Isn't it just filled out by the person who registered the domain?
    – Azendale
    Commented May 23, 2017 at 2:59
  • The reason I posted that is that you can use that info to contact Amazon. If it's not legit, they'll likely absorb the domain.
    – ShadoCat
    Commented May 23, 2017 at 18:24
  • 2
    @Azendale It's registered with MarkMonitor. Try registering an Amazon branded domain with them, and see what happens.
    – Xander
    Commented Feb 17, 2018 at 1:06

I believe it is phishing as well but not sure whats the goal other than ability to track which id is opened from which email/IP address. All links you click will take you to that page.

Or may be its an attempt to get victims to flood amazon? A colleague received a few of them recently and the Create Account link with url below which just redirects to legit amazon site.

http://www.amazonbusiness.com/e/54552/gistration-start-ref-b2b-e607a/lmkxl6/429776533 Note the number at the end doesn't matter, in fact I think they redirect everything to legit amazon site with some varying path.

But hey! If a real business send me email for account upgrade (that means I have an account already), do I even need to Create Account? A bit weird here.

It may be an experiment to see how many victims it can reach, rather than trying to steal login details yet? May be preparing for stage 2 attack targeting those who clicked (so victim's phishing awareness is at minimum).

  • 1
    It is clearly not a phish.
    – Xander
    Commented Feb 17, 2018 at 1:11
  • @Xander It may not be real phishing, but the practise of all hyperlinks on the page being the same - who will think it's legitimate business and not think it's a scam/phishing?
    – PatricK
    Commented Feb 18, 2018 at 22:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .