An Amazon Lure With an Alibaba Cloud Tracing Hop

The subject line said Amazon's best deals on gift gadgets were now live. The body matched: promotional layout, a bargain-newsletter persona on the From line reading "Deal Watchdogs - Gift Gadgets", and exactly one thing to click, a button labelled "Shop Our 10 Favorite Deals".

Amazon had nothing to do with any of it. Not the sending domain, not the tracking hop, not the landing page, not one asset in the chain. The retailer's only contribution was its name in a subject line, borrowed to move traffic somewhere else entirely.

Two mailboxes at a state government health and human services agency received it, with a manager also recorded on the incident. The platform had already resolved it as phishing and quarantined the message.

The Tracking Hop in the Middle of the Chain

Unwrap the button and the first thing it reaches is not a storefront. It is a tracing endpoint on dm-cn.aliyuncs[.]com, requesting a path under /trace/v1/report and carrying a set of tracking parameters. That host is Alibaba Cloud's shared customer service domain, the same category of asset as a link shortener or a link-in-bio page. It is not attacker-registered infrastructure. It is a mainstream cloud provider's analytics plumbing, in daily legitimate use by a very large tenant population, and it scanned exactly as clean as that implies.

Only after the tracing hop reports the click does the chain resolve to its real destination, a page on a subdomain of thedecordive[.]net. That domain has no relationship with the retailer named in the subject, and its mass-market registrar record predates the message by close to a year, so this is not throwaway same-day infrastructure either. Further links continued into an affiliate network: an unsubscribe path on hattablewheel[.]com that returned a mixed scan verdict rather than a clean one, plus redirect hops on smartclks[.]com and searchseniordiscounts[.]com.

That is the shape worth carrying out of this case. The middle hop belongs to a cloud provider nobody can reasonably deny, the terminal domain has aged past new-domain heuristics, and the branded surface at the front is the only obviously false part. MITRE ATT&CK files the delivery as spearphishing link, the brand dressing as masquerading, and the click as user execution. None of those steps requires the operator to own a single blockable asset outright.

SafeLinks Belonged to the Defender, Not to the Attacker

The analyst read of this message found a Microsoft SafeLinks wrapper sitting in front of the tracing endpoint, and that detail gets misfiled often enough to be worth stating plainly. SafeLinks is a recipient-side control. Microsoft 365 rewrites inbound URLs on delivery so a click can be evaluated at the moment it is made rather than when the mail arrived. Its presence means the receiving tenant's own protection layer touched the link. It is not a redirect the sender built.

What it does do is complicate triage, because a wrapped URL hides its destination until somebody decodes it. Note also what the raw link data can and cannot show: the decoded destinations appear in the incident record, while the wrapper is visible in the analyst's direct read of the message. Two Microsoft support and short-link URLs also appeared in the body, and those are Microsoft's own automatically appended anti-phishing footer, added to flagged mail. They are not attacker-crafted decoys.

See Your Risk: Calculate how many threats your SEG is missing

Fully Authenticated, With Nothing Left to Reject

The sending address sat on a mailing subdomain, pug.rayepughmusic[.]com, belonging to an apex domain with no apparent connection to retail promotions at all. Whoever operated that subdomain had DNS control over it and used it properly. SPF passed. DKIM passed. The domain published a DMARC policy of p=reject, the strictest available disposition, and the message passed under it.

An enforced reject policy is normally read as a sign of a well-run domain, and in a technical sense that reading is correct here. RFC 7489 defines DMARC to align the visible sending domain with an authenticated identifier and to tell receivers what to do when alignment fails. Alignment did not fail, so there was nothing for policy to act on. NIST defines phishing around deception rather than around the forgery of a technical identifier, and that distinction is the whole case. Authentication answered the question it was designed to answer, custody of a domain, while the deception lived entirely in the brand name and the imagery. That is exactly why DMARC monitoring and management is a reporting and visibility control rather than a content verdict.

No Login Form Anywhere in the Chain

The negative finding needs saying out loud, because a reader of a teardown will assume credential theft is the endpoint unless told otherwise. Nothing in this chain presented a login form, a credential prompt, or a payment field. The terminal destination was an offer page, and the surrounding links ran into an affiliate and advertising redirect network. Read as a whole, this is deceptive affiliate monetization wearing a retail brand rather than classic credential harvesting.

The response changes accordingly. There is no account to reset and no session to revoke. What remains worth recording is the chain, because the tracing endpoint, the aged landing domain, and the affiliate hops get reused behind whatever lure comes next. Scoring the full redirect path rather than each host in isolation is the work advanced URL and malware attack protection has to do when every individual hop is defensible.

Behavior Was the Only Signal Left

With authentication passing and the middle hops resolving to reputable providers, the decision came down to how the message behaved. Our Adaptive AI scored it at 90% confidence, flagged the call-to-action link, tagged the From line as a similar display name impersonation, and weighted a strong community signal from comparable resolved incidents across 35,000+ security professionals across 17,000+ organizations. The incident resolved automatically as phishing and the message was quarantined.

That ordering matters. The 2024 Verizon Data Breach Investigations Report puts the human element in 68% of breaches, and this message was built for that surface: a familiar retail name, a discount, urgency implied by the words "now live", and one button. Every mechanical check it faced returned a pass. CISA's phishing guidance argues the same thing defensively, that these campaigns win on presentation rather than infrastructure, which is why the presentation has to be scored.

Indicators of Compromise

MITRE ATT&CK Mapping

• T1566.002, phishing via spearphishing link, delivered as a single branded promotional button
• T1036, masquerading, a major retail brand's name and imagery wrapped around an unrelated affiliate chain
• T1204.001, user execution of a malicious link, the only interactive element in the message

The Takeaway

Three habits break here. A passing DMARC reject policy gets read as a safety verdict when it only states who controls a domain. A cloud provider's tracing endpoint gets scored on its host's reputation instead of the chain's purpose. And a SafeLinks wrapper gets logged as attacker infrastructure when it is the receiving tenant's own protection. Strip those misreadings away and what is left is a fully authenticated bulk mailer borrowing a retail brand to push clicks into an affiliate network, with no login form to make it look like phishing and nothing a blocklist can usefully hold.