Warning email from Amazon

[0xFeedBeef]

Yes.

so it's probably some reporting by the new API (to the effect of "yes, this title is definitely being watched") and not just ad correlation

[Cats4U]

There are two ways that Amazon has figured out the people are downloading (with StreamFab and its clones).

1) Lots of activity online at Prime Video, but no streaming being completed. This has already been discussed, and I think it might just be an initiating step where they decided to search for what was going on.

2) User-Agent Client Hints. Google it. This method provides all the information about the browser/client you are using to contact a server. A simple line called a User-Agent that looks something like this... Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36, was used on Chromium-based browsers previously. Somewhere around Chromium 90, User-Agent Client Hints became the default information transfer method. It provides a lot more information. StreamFab until relatively recently only used the User-Agent that matched the CEF that they use. Now, they seem to have a user-agent switcher that changes the User-Agent once in a while, but does nothing to change the Client Hints. Amazon is obviously using Client Hints to get their information on what browser/client you are using. Try this for yourself, in StreamFab enter the address of https://browserleaks.com/client-hints or better yet, https://www.deviceinfo.me. Amazing, how much they know about your client, aka StreamFab. The Client Hint that stands out to me is the browser - Chromium 135, but it could be anything that they are keying in on. If they see a client with a Chromium 135, they might go back and see how many complete streams of videos you watched. If you are showing 0 or a small amount and yet have a lot of activity online, the email gets sent.

[slottedpig]

There are two ways that Amazon has figured out the people are downloading (with StreamFab and its clones).

1) Lots of activity online at Prime Video, but no streaming being completed. This has already been discussed, and I think it might just be an initiating step where they decided to search for what was going on.

2) User-Agent Client Hints. Google it. This method provides all the information about the browser/client you are using to contact a server. A simple line called a User-Agent that looks something like this... Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36, was used on Chromium-based browsers previously. Somewhere around Chromium 90, User-Agent Client Hints became the default information transfer method. It provides a lot more information. StreamFab until relatively recently only used the User-Agent that matched the CEF that they use. Now, they seem to have a user-agent switcher that changes the User-Agent once in a while, but does nothing to change the Client Hints. Amazon is obviously using Client Hints to get their information on what browser/client you are using. Try this for yourself, in StreamFab enter the address of https://browserleaks.com/client-hints or better yet, https://www.deviceinfo.me. Amazing, how much they know about your client, aka StreamFab. The Client Hint that stands out to me is the browser - Chromium 135, but it could be anything that they are keying in on. If they see a client with a Chromium 135, they might go back and see how many complete streams of videos you watched. If you are showing 0 or a small amount and yet have a lot of activity online, the email gets sent.

So are you saying that if SF keeps chromium up to date that may be a possibilty? As far as i know they are a little behind on the chromium updates.

[IronicMan]

that's nonsense

i think your reply was nonsense, but if that's your honest and best reply, that's totally fine...as long as you're making an honest effort, i respect that.

[Cats4U]

So are you saying that if SF keeps chromium up to date that may be a possibilty? As far as i know they are a little behind on the chromium updates.

Maybe. It could be something else they might be keying in on. Chromium seemed the most obvious thing to me, but it could be something else. I'm definitely not an expert on the subject, so I might be way off the mark. I'll be doing a lot more reading on the subject tomorrow, when I get a chance. One thing I did read already seems to imply that if the client doesn't use JavaScript, it can't send back any information to the server. But then again, the server could possibly be programmed so that it will not connect to the client if it doesn't get the info. At https://news.ycombinator.com/item?id=34180160 they mention using NoScript (https://noscript.net/) to stop the JavaScript. Let the cat and mouse games continue.
I rarely download anything from Amazon Prime Video directly, but I did have two subscriptions for other providers that I had started to use more and more (until all the shows went on hiatus for the summer). I just cancelled them. I'm going back to torrenting for them. The reason I started with StreamFab to begin with was because I was feeling guilty about using torrenting all the time and not paying for anything. Paying the monthly fee helped to calm my guilt somewhat. I look at it just like time-shifting on a VCR or DVR. I don't always feel like watching what they make available when they make it available. By downloading it, I can watch it when I want to watch it. And unlike 9 out of 10 of you, after my wife and I watch a show, we delete it. Nor do we make it available to any of our friends or family. I don't consider myself a pirate, I look at myself as a time-shifter who is willing to pay a monthly fee to download videos to be watched later.

[Cats4U]

As far as i know they are a little behind on the chromium updates.

Straight from Gemini AI...

As of July 26, 2025, the latest stable Chromium CEF release is 138.0.33+g276ed6d+chromium-138.0.7204.169, which is based on Chromium 138.0.7204.169.

You can often find the most up-to-date information on the CEF Automated Builds page (https://www.google.com/search?q=cef-...spotifycdn.com) and the CefSharp GitHub releases page.

[slottedpig]

Maybe. It could be something else they might be keying in on. Chromium seemed the most obvious thing to me, but it could be something else. I'm definitely not an expert on the subject, so I might be way off the mark. I'll be doing a lot more reading on the subject tomorrow, when I get a chance. One thing I did read already seems to imply that if the client doesn't use JavaScript, it can't send back any information to the server. But then again, the server could possibly be programmed so that it will not connect to the client if it doesn't get the info. At https://news.ycombinator.com/item?id=34180160 they mention using NoScript (https://noscript.net/) to stop the JavaScript. Let the cat and mouse games continue.
I rarely download anything from Amazon Prime Video directly, but I did have two subscriptions for other providers that I had started to use more and more (until all the shows went on hiatus for the summer). I just cancelled them. I'm going back to torrenting for them. The reason I started with StreamFab to begin with was because I was feeling guilty about using torrenting all the time and not paying for anything. Paying the monthly fee helped to calm my guilt somewhat. I look at it just like time-shifting on a VCR or DVR. I don't always feel like watching what they make available when they make it available. By downloading it, I can watch it when I want to watch it. And unlike 9 out of 10 of you, after my wife and I watch a show, we delete it. Nor do we make it available to any of our friends or family. I don't consider myself a pirate, I look at myself as a time-shifter who is willing to pay a monthly fee to download videos to be watched later.

Dude, I feel the same way, i carry subs for many of the main services to give them the money they deserve and keep stuff for later, i defintely havent downloaded nearly as much as ive given them money for anyway. i dont ever delete it but i also dont share with anyone who wouldnt already have access to my accounts anyway pretty much the people who live in my house. Its just frustrating that i cant stream directly the way i want for instance, i have an HTPC that i like to use with kodi and i have a preshow setup for movies, i cant use that as far as i know without having the file locally stored and in the library. This is my main reason for SF. Like i said earlier, amazon is the most important service for many reasons, not only is it a store front but also most others including apple are now being offered through amazons interface which makes it super easy since you dont need all the logins or modules.

[Sebastian001]

This is not a private chat, you have to assume someone from Amazon could be reading along!


I wouldn't be surprised if these emails were sent using AI! In other words, there's no logic involved; they're probably using AI. Nobody is sitting there sending them manually.

[naszdom]

When post 122 had his account suspended, that was not AI

[DQ1]

There are two ways that Amazon has figured out the people are downloading (with StreamFab and its clones).

1) Lots of activity online at Prime Video, but no streaming being completed. This has already been discussed, and I think it might just be an initiating step where they decided to search for what was going on.

2) User-Agent Client Hints. Google it. This method provides all the information about the browser/client you are using to contact a server. A simple line called a User-Agent that looks something like this... Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36, was used on Chromium-based browsers previously. Somewhere around Chromium 90, User-Agent Client Hints became the default information transfer method. It provides a lot more information. StreamFab until relatively recently only used the User-Agent that matched the CEF that they use. Now, they seem to have a user-agent switcher that changes the User-Agent once in a while, but does nothing to change the Client Hints. Amazon is obviously using Client Hints to get their information on what browser/client you are using. Try this for yourself, in StreamFab enter the address of https://browserleaks.com/client-hints or better yet, https://www.deviceinfo.me. Amazing, how much they know about your client, aka StreamFab. The Client Hint that stands out to me is the browser - Chromium 135, but it could be anything that they are keying in on. If they see a client with a Chromium 135, they might go back and see how many complete streams of videos you watched. If you are showing 0 or a small amount and yet have a lot of activity online, the email gets sent.

I am sure it could be many things. But I don't think it's rocket science. To watch a stream, exhibits very different behavior than does downloading at max speed. Whether they outsource their CDNs or it's their own department, I am sure they can easily track who does what and the behavior of that client. I am sure they have logs that go back a year or more. They can probably run simple reports that points out the vast difference in behavior. It would stick out like a sore thumb. I am sure they could also use AI but that's not even needed I don't think. I run networks, I can do these things on my own networks and I am not a zillion dollar company.

I assume they probably sent out a random smattering of notifications based on some loose requirements. Could have been Amazon themselves, could have been someone they contracted to handle this based on who owns the CDNs. I think this was basically a warning shot across the bow. They probably really don't want to cancel accounts, they lose money that way. So they are tamping it down and saying, hey stop that.

I would imagine if it slows then they leave it alone. If it continues I would imagine they get more heavy handed. Maybe we can go back to a few safe downloads here and there, maybe not. They have probably chosen this route because it's less of a cost monetarily than changing encryption or making other major changes. At the end of the day it's all business.

Also, I am sure they read this forum. Because why would they not.

[paradox]

As naszdom said, it wasn't "Ai" but the emails are poor and cryptic. I suspect they have handed this over to another company, likely one of those ones that copyright-troll Youtube videos.

There is no way to contact them without LOGGING IN to a dead account so I just considered it a dead-loss. I'm just glad I made a burner account and a "monthly" one, on a secondary debit card with a I use solely for subs.



I had actually changed the UA string and had uBlock installed in the internal Chromium as a possible precaution if they were to ever "fingerprint" it, but I'm not 100% if that even carries into the SF container of it.

To be honest, it would not be hard for them to see no "streams" despite a good amount of GB usage per day, HLS traffic requests much faster than realtime and API requests during analysing. . I'm actually surprised it lasted as long as it did really.


Has anybody else missed the emails (mine both went to spam) and been actually nuked?

[october262]

As naszdom said, it wasn't "Ai" but the emails are poor and cryptic. I suspect they have handed this over to another company, likely one of those ones that copyright-troll Youtube videos.

There is no way to contact them without LOGGING IN to a dead account so I just considered it a dead-loss. I'm just glad I made a burner account and a "monthly" one, on a secondary debit card with a I use solely for subs.



I had actually changed the UA string and had uBlock installed in the internal Chromium as a possible precaution if they were to ever "fingerprint" it, but I'm not 100% if that even carries into the SF container of it.

To be honest, it would not be hard for them to see no "streams" despite a good amount of GB usage per day, HLS traffic requests much faster than realtime and API requests during analysing. . I'm actually surprised it lasted as long as it did really.


Has anybody else missed the emails (mine both went to spam) and been actually nuked?

see post 122 in this thread - https://forum.dvdfab.cn/forum/stream...m-amazon/page9

[lucas Zxc]

Hi all,

There is an API updates on Amazon website when accessing the vidieo playback information, we are working on this.


BTW, a same account is used for downloading the videos every day from Amazon US/DE/UK/JP, but we are still not receive the warning email or message.

For the warning email, you may can receive it in the Amazon Message Center or the email.



Wilson

so, like, this API change is the problem?
just for me to know

[DQ1]

see post 122 in this thread - https://forum.dvdfab.cn/forum/stream...m-amazon/page9

People admitted to doing all sorts of different behavior and some said not at all in quite some time so I am not sure why you keep posting that but it's not anything definitive.

[simchris]

Captain Obvious says:"if you act like a pir8 they will probably figure out you're a pir8." Still works for me just fine. Normal users don't have multiple accounts, rent without actually watching, trial and cancel repeatedly, zero or low "watch hours," account hopping, rotating IP addresses in short timespan, anonymous payment methods, low or no store purchases, etc., etc.