Date: 09/28/2026
Severity: High
Summary
Researchers highlight a Social Engineering campaign using attractive shipping-rebate offers to lure users into deceptive subscription programs with recurring monthly charges. The Phishing-style offers can obscure billing terms and lead victims to unknowingly enroll in paid memberships, making this an Online Fraud and Financial Scam involving deceptive billing and unauthorized recurring payments. The campaign involves shipping-themed websites, retailer promotions, browser pop-ups, checkout offers, and other channels that can make the source of recurring charges difficult to identify.
Indicators of Compromise (IOC) List
DOmain/URLs | free-shipments.com freeshipments.com freeshpmts.com myshipmentsfree.com shipmentfree.com shipmentsfree.com shipmentsfreeclub.com shipmentsfreezone.com |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "freeshpmts.com" or url like "freeshpmts.com" or siteurl like "freeshpmts.com" or domainname like "freeshipments.com" or url like "freeshipments.com" or siteurl like "freeshipments.com" or domainname like "shipmentsfreeclub.com" or url like "shipmentsfreeclub.com" or siteurl like "shipmentsfreeclub.com" or domainname like "shipmentsfree.com" or url like "shipmentsfree.com" or siteurl like "shipmentsfree.com" or domainname like "myshipmentsfree.com" or url like "myshipmentsfree.com" or siteurl like "myshipmentsfree.com" or domainname like "shipmentfree.com" or url like "shipmentfree.com" or siteurl like "shipmentfree.com" or domainname like "shipmentsfreezone.com" or url like "shipmentsfreezone.com" or siteurl like "shipmentsfreezone.com" or domainname like "free-shipments.com" or url like "free-shipments.com" or siteurl like "free-shipments.com" |
Reference:
https://www.malwarebytes.com/blog/threat-intel/2026/09/that-shipping-rebate-offer-may-come-with-a-monthly-charge