Amazon Shipment Update Scam
I received four Amazon shipping update scams in quick succession. How do I know they are scams? First I do not have an Amazon account or buy anything through Amazon but if I did just follow the simple rules... check senders e-mail address, appearance of the e-mail, the destination web address on the click button and finally if possible the ip address from where the e-mail orginated.
E-Mails received:
Date: 21/03/2025, 04:14
From: Amazon urgkajj@Amazon.com
To: [Name and E-Mail address redacted]
Subject: ***SPAM*** Your Amazon Order 250-8197579-8147749 Has Shipped!
Date: 24/03/2025, 05:02
From: Amazon voeqrpey@Amazon.com
To: [Name and E-Mail address redacted]
Subject: ***SPAM*** Your Amazon Order 250-8835749-8052549 Has Shipped!
Date: 24/03/2025, 05:02
From: Amazon gref@amazon.com
To: [Name and E-Mail address redacted]
Subject: ***SPAM*** Your Amazon.co.uk order (#026-2846414-6952521) has been dispatched
Date: 25/03/2025, 11:14
From: Amazon whjsyaqmr@Amazon.com
To: [Name and E-Mail address redacted]
Subject: ***SPAM*** Your Amazon Order 250-8445369-8411509 Has Shipped!
Notes
Senders e-mail, whilst these have the appearance of being genuine Amazon e-mail addresses all other factors suggest the e-mail addresses have been spoofed ie made to look as though they have come from an Amazon address and the e-mail addresses themselves... urgkajj@Amazon.com, voeqrpey@Amazon.com, gref@amazon.com, whjsyaqmr@Amazon.com. No serious, genuine commercial organisation would have the apparent random letters before the @ sign.
Appearance, there is no Amazon branding or logo to try and persuade you to believe the e-mail is from Amazon and the order numbers in the subject line do not match the order numbers stated in the body of the e-mail.
Link addresses, clicking the yellow "view you order" or "track your package" do not take you to a genuine Amazon website but to these addresses... https://amazon.813wl.com/shipping.amazon.com/, https://amazon.rtqgj.com/shipping.amazon.com/, https://amazon.szmkx.com/shipping.amazon.com, https://amazon.51jsa.com/shipping.amazon.com.
These are amazon named subdomains of the websites 813wl.com, rtqgj.com, szmkx.com, 51jsa.com finally directing you to a shipping.amazon.com named folder all to try and convince you that you are on a genuine amazon website.
Examination of the e-mail headers allows the ip addresses to be identified and searching on https://whatismyipaddress.com/ip-lookup gives an approximation to the sender's location.
1st e-mail: [182.127.153.141] China/Zhengzhou
2nd e-mail: [42.53.252.137] China/Shenyang
3rd e-mail: [116.115.184.1] China/Baotou
4th e-mail: [116.115.184.194] China/Baotou
I think we can say that none of those places are locations where Amazon operates.
Recommendation:
Just delete the e-mail.
Further e-mails received:
Seriously how many Amazon shipments do they think I might be expecting? A steady stream of e-mails with the same format, 3 per day.
Date: 26/03/2025, 02:45
Sender E-mail address: Amazon qcllb@Amazon.com
Button link (View Order details): https://amazon.jxcxh.com/shipping.amazon.com
Date: 26/03/2025, 09:29
Sender E-mail address: Amazon ohpu@Amazon.com
Button link (View Order details): https://amazon.hmfjy.com/shipping.amazon.com
Date: 26/03/2025, 17:27
Sender E-mail address: Amazon vvyio@amazon.com
Button link (Track your package): https://amazon.813wl.com/shipping.amazon.com
Date: 27/03/2025, 04:20
Sender E-mail address: Amazon bevfyoel@Amazon.com
Button link (View Order details): https://amazon.fz889.com/shipping.amazon.com
Date: 27/03/2025, 12:30
Sender E-mail address: Amazon smx@Amazon.com
Button link (Track your package): https://amazon.813wl.com/shipping.amazon.com
Date: 27/03/2025, 22.19
Sender E-mail address: Amazon ctjko@Amazon.com
Button link (Track your package): https://amazon.bjm6.com/shipping.amazon.com
Date: 28/03/2025, 07.54
Sender E-mail address: Amazon jfqjdw@Amazon.com
Button link (Track your package): https://amazon.813wl.com/shipping.amazon.com
Michael Fowler
Other articles by Michael Fowler:
SEO Services Spam - Michael Fowler
If you have a website be prepared to be inundated with emails from SEO companies offering to get you Google page 1 listings, for a price...
more >>
FBI Compensation of US$15 Million - Michael Fowler
Is it my lucky day when the Director of the FBI (Federal Bureau of Investigation) contacts me to tell me I am due compensation of US$15 Million?
more >>
Beluga Bible Translations - A Bit Fishy? - Michael Fowler
Alright we know a Beluga Whale is a mammal and not a fish. But what I am questioning is whether Beluga Bible Translations is a legitimate Christian Mission or whether it is fishy?
China Domain name Scam - Michael Fowler
The China Domain name Scam and what to do when you receive an e-mail from the Chinese Registrars.
Amory Dixon - Persistant Spammer - Michael Fowler
What happens when you reply to a persistant spammer.
Scamminder.com - Legit or Scam - Michael Fowler
Scamminder is it a legitimate Scam Detection website or a scam itself?
