Amazon Shipment Update Scam
I received four Amazon shipping update scams in quick succession. How do I know they are scams? First I do not have an Amazon account or buy anything through Amazon but if I did just follow the simple rules... check senders e-mail address, appearance of the e-mail, the destination web address on the click button and finally if possible the ip address from where the e-mail orginated.
E-Mails received:
Date: 21/03/2025, 04:14
From: Amazon urgkajj@Amazon.com
To: [Name and E-Mail address redacted]
Subject: Your Amazon Order 250-8197579-8147749 Has Shipped!
Date: 24/03/2025, 05:02
From: Amazon voeqrpey@Amazon.com
To: [Name and E-Mail address redacted]
Subject: Your Amazon Order 250-8835749-8052549 Has Shipped!
Date: 24/03/2025, 05:02
From: Amazon gref@amazon.com
To: [Name and E-Mail address redacted]
Subject: Your Amazon.co.uk order (#026-2846414-6952521) has been dispatched
Date: 25/03/2025, 11:14
From: Amazon whjsyaqmr@Amazon.com
To: [Name and E-Mail address redacted]
Subject: Your Amazon Order 250-8445369-8411509 Has Shipped!
Notes
Senders e-mail, whilst these have the appearance of being genuine Amazon e-mail addresses all other factors suggest the e-mail addresses have been spoofed ie made to look as though they have come from an Amazon address and the e-mail addresses themselves... urgkajj@Amazon.com, voeqrpey@Amazon.com, gref@amazon.com, whjsyaqmr@Amazon.com. No serious, genuine commercial organisation would have the apparent random letters before the @ sign.
Appearance, there is no Amazon branding or logo to try and persuade you to believe the e-mail is from Amazon and the order numbers in the subject line do not match the order numbers stated in the body of the e-mail.
Link addresses, clicking the yellow "view you order" or "track your package" do not take you to a genuine Amazon website but to these addresses... https://amazon.813wl.com/shipping.amazon.com/, https://amazon.rtqgj.com/shipping.amazon.com/, https://amazon.szmkx.com/shipping.amazon.com, https://amazon.51jsa.com/shipping.amazon.com.
These are amazon named subdomains of the websites 813wl.com, rtqgj.com, szmkx.com, 51jsa.com finally directing you to a shipping.amazon.com named folder all to try and convince you that you are on a genuine amazon website.
Examination of the e-mail headers allows the ip addresses to be identified and searching on https://whatismyipaddress.com/ip-lookup gives an approximation to the sender's location.
1st e-mail: [182.127.153.141] China/Zhengzhou
2nd e-mail: [42.53.252.137] China/Shenyang
3rd e-mail: [116.115.184.1] China/Baotou
4th e-mail: [116.115.184.194] China/Baotou
I think we can say that none of those places are locations where Amazon operates.
Recommendation:
Just delete the e-mail.
Further e-mails received:
Seriously how many Amazon shipments do they think I might be expecting? A steady stream of e-mails with the same format, 3 per day.
Date: 26/03/2025, 02:45
Sender E-mail address: Amazon qcllb@Amazon.com
Button link (View Order details): https://amazon.jxcxh.com/shipping.amazon.com
Date: 26/03/2025, 09:29
Sender E-mail address: Amazon ohpu@Amazon.com
Button link (View Order details): https://amazon.hmfjy.com/shipping.amazon.com
Date: 26/03/2025, 17:27
Sender E-mail address: Amazon vvyio@amazon.com
Button link (Track your package): https://amazon.813wl.com/shipping.amazon.com
Date: 27/03/2025, 04:20
Sender E-mail address: Amazon bevfyoel@Amazon.com
Button link (View Order details): https://amazon.fz889.com/shipping.amazon.com
Date: 27/03/2025, 12:30
Sender E-mail address: Amazon smx@Amazon.com
Button link (Track your package): https://amazon.813wl.com/shipping.amazon.com
Date: 27/03/2025, 22.19
Sender E-mail address: Amazon ctjko@Amazon.com
Button link (Track your package): https://amazon.bjm6.com/shipping.amazon.com
Date: 28/03/2025, 07.54
Sender E-mail address: Amazon jfqjdw@Amazon.com
Button link (Track your package): https://amazon.813wl.com/shipping.amazon.com
Michael Fowler
Other articles by Michael Fowler:
DHL Shipment Update Scam - Michael Fowler
I received the following e-mail supposedly referring to a DHL shipment en-route to me. I have no expectation that any shipment is en-route to me from DHL or any other carrier...
more >>
Vera Elasquez - Content Researcher and Freelance Journalist - Michael Fowler
This lady found my writing "exceptionally insightful. Your writing is not just informative, but truly illuminating on the subject. The clarity and depth of your research are remarkable"...
more >>
Government Gateway Phishing Scam - Michael Fowler
You can imagine the havoc and harm that can be inflicted if someone manages to trick you by a phishing e-mail redirecting you to a fake login page whereby you unknowingly reveal your username and password details...
more >>
Anti Virus Renewal Scam - Michael Fowler
Out of the blue comes an anti-virus program renewal e-mail. An anti-virus program you probably don't have. You are urged to respond urgently...
more >>