[UPDATED]

This is a breakdown of a Shopify verification email scam — one that looks clean, asks you to verify your email, and leaves no visible trace when you click. There’s no fake login page, no immediate credential theft. Here’s what it was actually doing. For broader context on the types of scam emails hitting Shopify merchants, see our Shopify store owner scams guide.

Overview

• Claimed to be a Shopify notification about new features requiring email verification for **************.com
• Actual sender: ********@michaellogistic.com — no affiliation with Shopify
• The verification link ran through a redirect chain: a French relay domain (bec-i.fr) forwarding to a processing endpoint on wandersplendor.com
• No credentials were harvested. The endpoint decoded a Base64-encoded recipient address and logged the visit — target validation, not an active attack

Step 1 — Sender Analysis: Is This Shopify Verification Email a Scam?

Claimed identity: Shopify notification

Actual sender: ******@michaellogistic.com

Shopify sends transactional email from @shopify.com or @mail.shopify.com.

michaellogistic.com has no affiliation with Shopify.

Step 2 — Email Body Red Flags

Use this prompt in any AI to help you break down any link without actually clicking it: “Don’t open this link. Analyze the structure: {link}. It was sent in my email – see the screenshot (add your screenshot).”

The email body contains several manipulation signals that become obvious once you know what to look for.

Subject line: [2] ***********.com verify now your email details The [2] prefix implies this is a follow-up to a message you already received. No prior message exists. The tactic creates artificial urgency — it makes you feel like you’ve missed something and need to catch up.

“This link remains active for 6 days.” A countdown with no trigger. Legitimate Shopify emails don’t include link expiry warnings in the body. This is pressure framing — act before it’s too late.

“For any questions, you may get in touch with the manager Julian.” There’s no last name, no ticket number, no support URL, and no Shopify Help Center link. Legitimate platform communications route to a support system, not a first-name-only contact. “Julian” is a social engineering placeholder — it implies a real person is watching your case, without any verifiable identity behind it.

151 O’Connor Street, Ground floor, Ottawa ON, K2P 2L8 This is Shopify’s real headquarters address, copied directly from legitimate Shopify emails. The address is accurate. The email is not. This detail was included specifically to pass visual inspection — a recipient who Googles the address will find Shopify’s real office and assume the email is legitimate. This pattern — real branding, real address, fake sender — shows up across every category of Shopify scam email we’ve documented.

The Shopify bag icon in the footer Same tactic. Stolen branding, not affiliation.

Step 3 — Extracting the Link (Without Clicking)

The “Verify your email details” button contained this link:

hxxps://www[.]bec-i[.]fr/shop/linkamazon[.]php?link=https://wandersplendor[.]com/sfpy/?=aW5mb0BjaG9yZWdpcmwub25saW5l

Two things stand out before any further analysis:

• linkamazon.php is a redirect script. bec-i.fr is not the real destination — it’s a relay. The actual target is hidden inside the link= parameter.
• The trailing value (aW5mb0BjaG9yZWdpcmwub25saW5l) is encoded. Not URL-encoded.

---

Step 4 — Breaking the Redirect Chain

Using a redirect checker:

bec-i[.]fr → HTTP 302 → wandersplendor[.]com/sfpy/?=aW5mb0BjaG9yZWdpcmwub25saW5l → HTTP 200

bec-i.fr is a French domain acting as a relay. The PHP script forwards the visitor to the final endpoint on wandersplendor.com. No more redirects.

Final destination:

hxxps://wandersplendor[.]com/sfpy/?=aW5mb0BjaG9yZWdpcmwub25saW5l

Step 5 — Decoding Hidden Data

The parameter at the end of the URL: aW5mb0BjaG9yZWdpcmwub25saW5l

This is Base64 — a standard encoding method that converts text into a URL-safe string. Decoding it reveals the recipient’s email address. Redacted here for privacy.

Legitimate email verification links don’t Base64-encode the recipient’s address inside a URL parameter. When this pattern appears, it means the link was personalized. Each target received a unique URL that identifies them the moment they click. As a result, the attacker doesn’t need you to fill in a form. The click itself is the data.

Step 6 — Safe Environment Testing

The final URL was loaded using:

• urlscan.io – passive scan, no local execution
• Browserling – remote browser, fully isolated

Observed:

• Response size: ~2 KB
• No visible page content
• No HTML
• No JavaScript
• No cookies set
• No more redirects

This is not a webpage. It’s a processing endpoint — a server-side script that receives the request, executes silently, and returns an empty response.

Step 7 — What the Endpoint Actually Does

Based on the observed behavior, the likely execution sequence is:

1. Request arrives at wandersplendor.com/sfpy/
2. Server decodes the Base64 parameter → retrieves the recipient’s email address
3. Logs the visit: IP address, timestamp, email address, user agent
4. Returns an empty ~2 KB response

There’s no credential prompt, no fake login page, no immediate data theft.

This is a target validation. The harm is passive: the attacker now knows this email address belongs to a real person who opens links. That information has direct value in a targeting pipeline — it separates engaged recipients from dead addresses.

Step 8 — What Would Happen Next

This link does nothing visible to the recipient. That’s by design.

After a click is logged, the likely follow-up:

• The address gets marked as active in the attacker’s list
• Follow-up emails arrive, better targeted and more convincing
• A second campaign introduces an actual credential-harvesting page — now with confidence that the target engages

Most people dismiss a link that returns a blank page. That’s the mechanism. Silent validation with no visible consequence. Meanwhile, the attack hasn’t happened yet — but the groundwork has been laid.

Key Takeaways

This Shopify verification email scam had no immediate payload — but it had a clear purpose. Here’s what generalizes beyond this specific email.

1. An auto-blocked sender is evidence, not background noise.

The email client flagged michaellogistic.com before the email was opened. That flag reflects a known reputation problem with the domain. It deserves attention.

2. Stolen branding and a real company address don’t make an email legitimate.

Shopify’s logo and Ottawa address are public. Anyone can copy them. Legitimacy is determined by the sender domain and the link infrastructure — not the visual design of the email body.

3. A numbered subject prefix with no prior email is a pressure tactic.

[2] implies you already missed the first message. You didn’t. The goal is to create a sense of urgency and a feeling of being behind.

4. Links that return blank pages are not harmless.

No visible content does not mean no server-side activity. A ~2 KB response from a PHP endpoint means the script ran. What it logged is a separate question — but the request was processed.

5. Base64-encoded parameters in verification links are a red flag.

Legitimate email verification does not encode the recipient’s address in a URL parameter. When encoded data appears in a verification link, the URL is designed to identify you when clicked.

6. Rotating infrastructure is a sign of automation, not sophistication.

Different sender, relay, and endpoint domain — same template, same encoding, same /sfpy/ path. When variables change while the overall structure stays the same, it is referred to as an automated campaign. The rotation is used to prevent detection based on patterns, instead of targeting individuals specifically.

7. A trusted domain in the redirect chain is not evidence the email is safe.

wagmap.jp is a real Japanese government portal. It wasn’t hacked. Its RequestPage= parameter accepts any URL and redirects without validation — a design flaw the attacker exploited. A clean relay domain does not provide information about the final destination.

Final Verdict

Category	Result
Sender legitimacy	Fake — *****@michaellogistic.com, not Shopify
Subject line	Manipulative — false follow-up via [2] prefix
Link transparency	Obfuscated — redirect chain + Base64-encoded parameter
Final destination	Processing endpoint on wandersplendor.com
Immediate risk	Low
Strategic intent	Target validation — logging active recipients for future attacks

Repeatable Checklist

1. Check the actual sender domain — not the display name
2. Note any auto-block or spam flag from your email client
3. Look for pressure signals: expiring links, numbered subject prefixes, unnamed contacts
4. Extract the link — do not click it
5. Check the redirect chain using a redirect checker tool
6. Decode any encoded URL parameters (Base64, URL encoding)
7. Test the final URL in urlscan.io or a remote browser
8. Analyze endpoint behavior: content, cookies, response size, scripts

UPDATE !

A second scam email purporting to be from Shopify arrived the next day, sent to the same recipient. It had a different sender, a different relay, and a different endpoint domain, but retained the same structure.

Sender: dev@choose-your-crowd.qa.r... (truncated in client)

Relay domain: www2.wagmap.jp Final endpoint: hxxps://pureplayclubs[.]com/sfpy/?=aW5mb0BjaG9yZWdpcmxmYXNoaW9uLmNvbQ==

Manager name: Charlotte (was Julian)

Link expiry: 5 days (was 6)

The Base64 parameter decoded to the recipient’s email address — same encoding pattern as the first email, redacted here for privacy.

www2.wagmap.jp is a legitimate Japanese municipal GIS portal.

It wasn’t compromised. The exploit is its RequestPage= parameter, which accepts any external URL and forwards the visitor there with no validation. This is an open redirect — the attacker passes their endpoint as the value, and the government domain does the forwarding.

hxxps://www2[.]wagmap[.]jp/e-machimap/G0304C?IsPost=False&MapId=1&RequestPage=https://pureplayclubs[.]com/sfpy/?=…

Using a legitimate government domain as the first hop is deliberate. Link scanners that check the relay domain will see wagmap.jp — clean and trusted — and pass it. The malicious endpoint only appears after the redirect.

/sfpy/ appears on both endpoint domains. wandersplendor.com/sfpy/ in the first email. pureplayclubs.com/sfpy/ in the second. Different domains, identical path. Both endpoints are executing the same script, indicating either a single attacker managing multiple domains or the deployment of the same toolkit across compromised sites.

The rotating variables confirm this is an automated campaign.

Sender domain, relay, endpoint domain, manager name, and expiry window all changed. The template and encoding did not. The rotation exists to bypass pattern-based detection. The recipient address in the URL is what ties both emails to the same target.

Two additional takeaways from this second email:

Rotating infrastructure is a sign of automation, not sophistication.

When the variables change while the overall structure remains the same, we are observing a templated campaign. The rotation is evasion, not targeting.

A trusted domain in the redirect chain doesn’t ensure the email is safe. You know, it’s interesting how attackers tend to take advantage of open redirects on well-known sites like government pages, universities, and big software services. People tend to trust those kinds of sites, which kind of helps the bad guys get away with their scams.

New to EmailClarity? Here’s what we do and why we built it.

[UPDATE]

A third email from the same campaign arrived April 28. Same template, same /sfpy/ endpoint path, same Base64-encoded recipient address. New sender, new relay country, new framing.

Sender: controlroom.nairobi@solvit-security.com Display name: Action needed: Shopify account update Relay domain: www.jmnetworks.cz (Czech Republic) Final endpoint: hxxps://uysmartly[.]com/sfpy/?=aW5mb0BjaG9yZWdpcmxmYXNoaW9uLmNvbQ== Link expiry: 9 days (was 6, then 5) Manager reference: None — replaced with a “we’re here to help” hyperlink

The relay uses an open redirect via the redirect= parameter — the same mechanism as wagmap.jp in Email 2, applied to a Czech business domain.

The display name escalated. Previous emails used “Shopify notification” as the display name. This one uses “Action needed: Shopify account update” — a more alarming framing designed to prompt faster action before the sender domain is inspected.

The manager name is gone. Emails 1 and 2 used a first-name contact (“Julian”, “Charlotte”) as a social trust signal. This email replaces that with a hyperlinked “we’re here to help” — likely a second tracking link, though unconfirmed.

Element	Email 1	Email 2	Email 3
Sender	vladi@michaellogistic.com	dev@choose-your-crowd.qa.r…	solvit-security.com
Relay domain	bec-i.fr (France)	www2.wagmap.jp (Japan, govt)	Czech Republic
Relay method	PHP redirect script	Open redirect via RequestPage=	Open redirect
Final endpoint	wandersplendor.com/sfpy/	pureplayclubs.com/sfpy/	uysmartly.com/sfpy/
Base64 payload	Recipient email	Recipient email	Recipient email
Manager name	Julian	Charlotte	None
Expiry framing	6 days	5 days	9 days

Three emails over six days. Three different sender domains, three different relay domains across three countries, three different endpoint domains. The /sfpy/ path and Base64 encoding pattern have not changed once.

Stay Safe With EmailClarity

Every week, we break down real scam emails targeting online store owners — the kind that land in your inbox pretending to be Shopify support, fellow entrepreneurs, or marketing geniuses who can triple your sales overnight.

Use our email analysis tool at scan.email-clarity.com to scan suspicious emails instantly, or forward anything sketchy to blog@email-clarity.com and we’ll give it our honest take.

The more emails we collect, the more store owners we can help. Your sketchy inbox is someone else’s warning sign.

Stay sharp out there.

— The EmailClarity Team