amazon[.]ses-iam[.]com

Amazon.ses-iam.com was observed targeting the Amazon brand with an E‑Commerce impersonation campaign. The domain was registered on June 04, 2025 through Hosting Concepts B.V. d/b/a Registrar.eu and uses the nameservers ina1.registrar.eu, ina2.registrar.eu, ina3.registrar.eu, and ryleigh.ns.cloudflare.com. DNS resolution points to IP address 15.197.130.221, an address within Amazon’s AS16509 network located in the United States. No TLS certificate is presented, meaning the site was reachable only via plain HTTP.

The page title returned by the server is “ses‑iam.com”, which does not contain the Amazon brand and suggests a generic landing page. VirusTotal scans recorded 10 detections out of 95 vendor engines, and the domain appears on a single public blocklist. Google Safe Browsing flags it for social engineering, and PhishDestroy has already taken the site offline. Scamadviser assigns a trust score of 1 / 100, reinforcing the malicious assessment.

The primary threat indicator is the explicit impersonation of Amazon, categorized as an E‑Commerce scam, although the exact payload or phishing page content has not been disclosed. Because the infrastructure resides on Amazon‑owned IP space, threat actors may be leveraging legitimate cloud resources to host malicious content, complicating takedown efforts. Defenders should continue to block the domain and its associated IP, monitor for any reuse of the same IP range for similar campaigns, and consider stricter e‑mail and web gateway policies for traffic to Amazon‑related subdomains that lack valid TLS. Ongoing intelligence collection should focus on any new subdomains registered by the same registrar or using the same nameserver set, as they may indicate further impersonation attempts.