
Ask HN: Got a fresh phish today: “Follow up to new Prime pricing and free promo” - masonic
That was the subject line.  Anybody else seen this?  Part of what concerns me is that it came to the address I do use for Amazon (and not much else).<p>Select lines from the header:<p>Return-Path: &lt;01000159609e18bc-653f20c5-fb10-4a80-87f9-3aaa638efa5e-000000@amazonses.com&gt;<p>Received: from a9-67.smtp-out.amazonses.com (a9-67.smtp-out.amazonses.com. [54.240.9.67])<p>Received-SPF: pass (google.com: domain of 01000159609e18bc-653f20c5-fb10-4a80-87f9-3aaa638efa5e-000000@amazonses.com designates 54.240.9.67 as permitted sender) client-ip=54.240.9.67;<p>DKIM-Signature: v=1; a=rsa-sha256; q=dns&#x2F;txt; c=relaxed&#x2F;simple; s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw; d=amazonses.com; t=1483384690; h=Message-ID:Date:Subject:From:To:MIME-Version:Content-Type:Feedback-ID; bh=KlVPQqTXT2zb6Y9xwXYfvP8SYIpWHh0GthjR8Q7iByU=; b=u9vM7GZMzqt03Vq1OX+NkG8FcsrrFyZxwTOkfLSPrIyWTu8tFL526ImGOPmpFns&#x2F; 5YEjb6g226az++hW+OGDpN8V5JrP3BbKMWztBPbdQRLF1xjuC+5nacaZAaO0sZDX5lt ODHRN612wDuZ55pZNv&#x2F;ARN6uz7+4QEs4uEg4f4fo=<p>Subject: Follow up to new Prime pricing and free promo<p>From: Janine from Insync &lt;support@insynchq.com&gt;<p>X-SES-Outgoing: 2017.01.02-54.240.9.67
Feedback-ID: 1.us-east-1.kMPw8yWuaLivva0y4oCs8H+U0sOXjFz&#x2F;H1BJQEUL2g0=:AmazonSES<p>Link in the body was: [http:&#x2F;&#x2F;berenice.eocampaign1.com&#x2F;67a2a516-d10b-11e6-8561-06ead731d453&#x2F;acd0a=
9b3-d11d-11e6-8561-06ead731d453&#x2F;9a4aa60e-c786-11e6-90cc-06ead731d453&#x2F;link-c=
lick]
======
dvdhnt
I may be wrong, but it looks like your fake "amazon" spam is ironically being
delivered via Amazon's Simple Email Service (SES)?

[https://aws.amazon.com/ses/](https://aws.amazon.com/ses/)

