The * stands for a machine-generated segment — this service mints a fresh hostname per device or install (a UUID or random blob), so the individual hostnames carry no information the family doesn't. We group them into one claim per app: corroboration is counted across all member hostnames, and every claim below cleared the same two gates as everything else on this site — separate accepted donations and human review.
*.appsync-api.us-east-1.amazonaws.com
A hostname family · classified as first-party
What our research panel found AI-drafted · human-reviewed
We ask several independent AI models the same question and publish their answers separately — cross-vendor agreement is evidence against fabrication, and disagreement is worth seeing. 3 of 3 models answered, overall confidence medium — classification split: anthropic=first-party, openai=unknown, gemini=first-party. A human reviewed this domain's claims before anything here published.
Anthropic Claude — first-party
The host is an AWS AppSync (managed GraphQL) endpoint under amazonaws.com, Amazon's own cloud infrastructure, contacted by Amazon's own app, so it most likely serves first-party app backend functions; note that AppSync subdomains are opaque customer-specific API IDs, so the specific service behind it cannot be identified from the domain alone. The app's label already declares broad collection (including user IDs, app interactions, and purchase history), so nothing here implies a data flow outside the declared label.
OpenAI — unknown
This is an AWS AppSync API endpoint, a managed backend service, but the opaque endpoint name does not establish which party operates it or what data is transmitted. The contact alone does not demonstrate a data flow outside the app's broad declared collection and sharing categories.
Google Gemini — first-party
The domain belongs to AWS AppSync, an Amazon Web Services backend API service hosting first-party infrastructure for the Amazon Shopping app. Because this is first-party infrastructure supporting core app functionality, the contact does not indicate an undisclosed third-party data flow.
Apps measured contacting this family
| App | Hostnames | Donations | Contacts | Seen |
|---|---|---|---|---|
| Amazon Shopping | 1 | 7 | 32 | 2026-07-28 → 2026-07-30 |
| Amazon Business: B2B Shopping | 1 | 4 | 12 | 2026-07-28 → 2026-07-29 |
Member hostnames observed
1 distinct hostname in the published evidence:
vlo7ege5lvdwrpxngqb5khopha.appsync-api.us-east-1.amazonaws.com
Think something here is wrong?
Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.