Intel Name: Pdf files with links to phishing sites impersonating amazon
Date of Scan: January 27, 2025
Impact: High
Summary: We recently analyzed 31 PDF files containing links to phishing sites impersonating Amazon. Notably, none of these PDFs had been submitted to VirusTotal at the time of discovery. The initial URLs in the PDFs redirect to subdomains of duckdns[.]org, which host the phishing websites. These sites employ cloaking techniques to redirect scans and analysis attempts to benign domains, with most initial and intermediate staging URLs hosted on the same IP address.
