Fake Kindle E-Book Order Confirmations Lead to Malicious Sites

The Internet Patrol default featured image
Share the knowledge

Starting early this morning, a rash of fake Kindle ebook orders hit the Internet. Designed to alarm the recipients into thinking that their Amazon accounts have been charged outrageous amounts for ebooks that they didn’t order, going to addresses they don’t recognize (including “Gahanna, United States”) the links to “your account” actually take the unsuspecting recipients to malicious sites.

The subject of the email is usually “Your Amazon.com Kindle e-book order confirmation” or “Your Amazon.com Kindle e-book order receipt” and appears to come from “digital-no-reply@amazon.com” “Thanks for your order (your email address)!” the email starts out, going on to say “Did you know you can view and edit your orders online, 24 hours a day? Visit Your Account.” Don’t fall for it!

So far we have seen versions containing “orders” going to Drew Giles, Tarik Haley, Garrison Herring, Nancy Cooper, and Jerry Vance, in Gahanna, Fort Wayne, and Ohio. Interestingly, the street address is always in the form of three digits, a dash, and four more digits, such as 503-8878, 145-4838 and 806-5684. In fact, several of these “people” seem to live at an address of 145-4838, and wonder if the “street address” represents the spammer’s affiliate code.

Even more dastardly, every link goes to a different hacked website running WordPress, hitting a page called “amaz.html”, where the malicious payload is waiting to infect your computer, making your computer one of their botnet. Our research tells us that this related to the Sakura exploit malware.

Anyways, here is a sample – again, please don’t fall for this!

The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.

CashApp us Square Cash app link

Venmo us Venmo link

Paypal us Paypal link


From: Amazon.com (digital-no-reply@amazon.com)
Subject: Your Amazon.com Kindle e-book order.
Date: May 25, 2012 11:04:24 AM MDT

Thanks for your order, (email address omitted)!

Did you know you can view and edit your orders online, 24 hours a day? Visit Your Account.

Order Information:
E-mail Address: (omitted)
Billing Address:
Drew Giles
145-4838 In Road
GAHANNA
United States
Phone: 1-747-517-7595

Order Grand Total: $ 55.99
Earn 3% rewards on your Amazon.com orders with the Amazon Visa Card. Learn More
Order Summary:
Details:
Order #: N63-3450793-8700973
Subtotal of items: $ 55.99
——
Total before tax: $ 55.99
Tax Collected: $0.00
——
Grand Total: $ 50.00
Gift Certificates: $ 5.99
——
Total for this Order: $ 55.99

The following item is auto-delivered to your Kindle or other device. You can view more information about this order by clicking on the title on the Manage Your Kindle page at Amazon.com.
The Hunger Games by Suzanne Collins [Kindle Edition] $ 55.99
Sold By: Random House Digital, Inc.

You can review your orders in Your Account. If you’ve explored the links on that page but still have a question, please visit our online Help Department.

Please note: This e-mail was sent from a notification-only address that cannot accept incoming e-mail. Please do not reply to this message.

Thanks again for shopping with us.

Amazon.com
Earth’s Biggest Selection

Prefer not to receive HTML mail? Click here

Get New Internet Patrol Articles by Email!

The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.

CashApp us Square Cash app link

Venmo us Venmo link

Paypal us Paypal link

 


Share the knowledge

One thought on “Fake Kindle E-Book Order Confirmations Lead to Malicious Sites

  1. I just got hit with this today. Mine was for 56.99. The email is very well done. If the email address had been my actual Amazon address, it would’ve been convincing.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.