Phishing PDF with Unusual Hostname, (Sat, May 2nd)

Taking a look with pdfid.py at a PDF received 2 days ago to update Amazon Prime account information:

Article Link: https://isc.sans.edu/diary/rss/26078