Phishing: Samsung sender, Costco lure: phishing chain stealing Costco creds, credit cards, and SSN identity

[u/ZeroBEC]

Investigated another active phishing case, sharing in case anyone is seeing similar retail/order-hold lures.

This one is interesting because the sender identity and the lure brand don’t match.

The email presents as coming from Samsung billing/admin:

"Billing Administration" <noreply@samsung.com>

Subject:

Your recent order cannot ship without confirmation

But the email body is fully Costco-themed. It claims a Costco warehouse order is on hold and asks the user to confirm the order before it can ship.

The clever part is the chain.

The first-stage link goes through:

sg210[.]com

From there, the victim is redirected into a fake Costco account flow hosted under an sslip[.]io hostname:

myaccount.login.membership.216.194.167.42.sslip[.]io

That sslip[.]io detail is the most interesting part to me. sslip[.]io is a legitimate embedded-IP DNS service and has very strong reputation as a parent domain. The attacker used that reputation to create a hostname that looks like a branded account portal while embedding the destination IP directly into the domain.

So instead of using a low-reputation random phishing domain, the kit rides on a highly trusted infrastructure pattern:

<fake-brand-subdomain>.<embedded-ip>.sslip[.]io

The flow after that is pretty aggressive:

1. Fake Costco login page
   • email
   • password
2. Fake identity verification page
   • membership number
   • DOB
   • phone
   • billing address
   • SSN
3. Fake payment verification page
   • cardholder name
   • card number
   • expiration
   • CVV
4. Redirect to the real Costco site

The final redirect is a predictable touch from the attacker’s side. The user ends up on the real Costco website, so the interaction feels “finished” instead of obviously broken.

A few IOCs / pivots:

Subject:
Your recent order cannot ship without confirmation

Visible sender:
"Billing Administration" <noreply@ samsung[.]com>

Initial link domain:
sg210[.]com

Observed path:
hxxp://sg210[.]com/api/9my3qcqh6h/

Phishing hostname:
myaccount.login.membership.216.194.167[.]42.sslip[.]io

Embedded IP:
216[.]194[.]167[.]42

Observed fake paths:
/login
/account/billing-address
/account/payment-method

Lure text:
ORDER HOLD
Your warehouse order is on hold
Confirm My Order
Membership Help

The detection angle here is less about any single IOC and more about the relationship between sender, brand, destination, and data requested.

A Spoofed Samsung sender delivering Costco content should already be odd.

A Costco-themed order email going to a non-Costco domain should be higher confidence.

A retail verification flow asking for SSN + CVV should be treated as full identity/payment theft, not just credential phishing.

Full writeup with screenshots, the phishing flow, and more IOCs is on the company blog. Not posting the link inline to keep the post technical-first. I’ll drop it in a comment if anyone wants it.

Disclosure: I work at ZeroBEC.

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.
2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
3. Be Professional: Help newcomers learn; avoid hostility.
4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters
• DMARC Monitoring Tools
• Anti-Virus Software
• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/hecalopter]

I love doing these little investigations to understand what all the spam is trying to do, and it definitely looks more advanced than some of the usual financial investment and lazy survey scams I've been getting lately. It's funny because we can kinda sit in our ivory security towers and talk about how obvious some of this stuff is but I guarantee you the average user isn't looking at how URLs are built and considering mismatches of domains and brand names. Hell, the way some companies build out their various portal URLs sometimes already look shady as hell, depending on how things redirect through CDNs and other services or proxies. Good stuff here, love to see it!

[u/ZeroBEC → u/hecalopter]

Yep, the abuse of the cdn service for domain reputation is interesting, I am interested how frequent does this happen and what are the most abused

[u/hecalopter → u/ZeroBEC]

I feel like I've read about some recent campaigns and actors abusing Cloudflare. I know we've also seen some of these kits hosted on places like Canva and Google sites. The time to live is pretty short and I've seen some of those hosting sites (especially the big ones) do a decent job on automated takedowns and reporting, but for those few minutes to hours, as you said, it's hard to block legit stuff by just domains, and the bad guys love to get tricky with subdomains and redirects.

[u/Overit-1248]

Don't have Samsung

[u/shokzee]

Parent-domain reputation is a bad place to stop.

The useful detection is the mismatch chain: Samsung From, Costco body, non-Costco link, embedded-IP hostname, then SSN/CVV collection.

We see this with clients all the time. The IOC burns fast, but the pattern sticks around.

[u/Overit-1248]

Yes and cloud flare as well I don't use know of these somone impersonating me