Beware this fake ShopBop order email

Beware this fake ShopBop order email

Summary: I was nearly scammed into downloading malware today by a cleverly executed phishing email that just arrived in my inbox


I just received an email purporting to confirm an order that I never placed at online retailer In fact, the order doesn't exist and the email doesn't come from the retailer. Although it looks perfectly genuine (see picture), if you click on the URL to view the order details, it takes you to a site that downloads and runs a malware file on your machine. This is because the domain in the clickable link is not the genuine but a cleverly disguised lookalike name.

A quick search on Twitter reveals that several other people have received this today. It demonstrates how clever phishing fraud is becoming these days. Your first reaction is to furiously gasp, 'I didn't order that!' and click on the link to see exactly what is going on. I was just about to do just that when I realized that something didn't add up. So I hovered over the order details URL and saw that the domain it linked to was subtly different. Although it might have been legitimate, a quick check of the domain in my browser showed that it was trying to download an executable zip file to my PC.

This is a fresh fraud with no easy-to-find information coming up (at the time of writing) from a Google search, which illustrates the value of Twitter for getting up-to-the-minute information about new threats and events. Most of all, though, it demonstrates why you must always have your wits about you in the online world. Interestingly, though, it looks as though the URL it links to is already getting shut down by malware prevention tools (for example,'s customer service email address rejected my email trying to advise them of the scam, presumably because of the link it contained). That in turn demonstrates the power of cloud-based malware prevention today.

Topics: Browser, Collaboration, E-Commerce

Phil Wainewright

About Phil Wainewright

Since 1998, Phil Wainewright has been a thought leader in cloud computing as a blogger, analyst and consultant.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • phishing from an amazon lookalike

    i got a similar email looking like it was from amazon letting me know that my order has been canceled and the link to the order number was a malware link.
  • Received same, thank you for posting!

    Almost clicked on this nasty piece of work, props to google for indexing this story and returning it for a "shopbop phishing" search!
  • Avoiding phishing

    For a few bucks a year, get a URL of your own, such as, then whenever you give a site your email address, add all or part of their name to the end of your name, such as or MyNameCitiBnk@MyURL.COM. Then if you get an email supposedly from Amazon and it doesn't have the email address to you with "Amzn" in it, you know it's bogus. Having customized email addresses also makes it easy to block a particular sender if you want to.
  • Thanks for the reminder....

    ...that even tech-savvy people can be tricked.

    It helps to keep a record of your online purchases. If you never placed an order with a business, you have no reason to click on their email regarding your "order."

    The people who create these scams should be boiled in oil. Death is too good for them.
    sissy sue
    • RE: The people who create these scams should be boiled in oil

      No, I would rather see them used in LIVE bayonet training (as the `dummy`).
  • $281+ For Two Pairs of Pants

    $281+ for two pairs of pants would have been a clue.
    The headlines would have read "Husband's Pants Puts Wife into Murderous Mood"
  • Shopbop lies to me

    Last month, i made shopping from shopbop. They assured my order would come in 3 days but I got my order in 5 days. It's such a hard time to wait for and also it's so much costly. I found porducts some of the denim jeans I have been purchased from are much better than those are in shopbop.
  • Shobop sent me a spam email already

    Last year, they sent me an email to reply a complaint of their customer. Poor him/her not to received his email but she or he are very lucky to not to hear about their blame. Their customer service department may look like a chaos. is still my familiar destination.