To add to this - what they probably did was run an nslookup or dig against the domains themselves. And whatever IP resolved for those domains, they checked who owned that IP space. With a CDN, it won't show AWS, it'll show the CDN.