Imposter Amazon Site Targets Shoppers in India

Alpha Team has identified an imposter Amazon site targeting shoppers in India. This site offers electronics at a steep 98% discount, in order to lure potential victims into entering personal and payment card information which could then be used by this scammer to drain a victim’s bank account, or could be sold on a carding forums for profit.

Recommendations

Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
Always verify that the domain you are visiting matches what you would expect, particularly when clicking through links in web searches
Always verify the sender of unexpected or suspicious emails, and never open attachments or click links in these emails
Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

Alpha Team has identified an imposter Amazon website, which phishes for PII and payment card information, targeting Indian customers. The site spoofs the legitimate Amazon.in site, and has gone as far as ripping off the legitimate Amazon.in logo as well as many other design elements of the site. The homepage uses a graphic referencing Diwali, a festival which took place October 27, 2019. The site was registered October 11, 2019, and given that Diwali is long since over, it appears not to have been updated since first created.

Figure 1. Homepage of impersonating Amazon.in site

In order to lure victims into entering their information, the site offers a selection of “Mobile Phones Upto 98% Off.” These prices equate to about $30 USD, which perhaps should be an indication that this is a scam. Clicking on one of these discount phones takes users to a page with an option to “Add Delivery Address.” It is not possible to add multiple items to the cart, and the discount phone links are actually the only elements of the homepage that are clickable.

Figure 2. Page view after adding item to cart

The first phishing page in the checkout process requests various shipping-related information from the victim, like address and phone number. After this information is submitted, the victim is redirected to a payment page.

Figure 3. Payment card information phishing page

This payment page also includes a purchase protection badge, likely intended to assure users who are attempting to make purchases from this site. Finally, after submitting payment information, the user is redirected to a success page, where they are urged to continue shopping.

Figure 4. Purchase success page

Conclusion

Amazon scams are common - but typically, they simply phish for login credentials. This phishing site is interesting in that it imitates an online shopping experience to obtain payment card information from users. Despite being a relatively good impersonation, there are several giveaways that indicate this is a scam site. There are small grammatical errors on the home page, many links aren’t actually clickable, and the shopping cart functionality differs from that of the legitimate Amazon site. Additionally, that electronics are being offered for 98% off, is highly suspicious. To mitigate risk, ZeroFOX recommends following the recommendations detailed above.

ThreatFeed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/114/list_indicators/