Phishing Campaign Analysis

Research Overview

This research involved the identification, analysis, and documentation of an active phishing campaign targeting mobile users with fake “BigMart Anniversary Prize” offers distributed via WhatsApp and Telegram.

Target

Two phishing domains:

• bigmartprizeq.com — Landing page with mobile detection
• bigmart-gift.com — Main phishing application

Research Objective

To understand the phishing infrastructure, document the attack flow, identify data collection mechanisms, and report the campaign to relevant authorities.

Methodology

The research combined:

• Domain reconnaissance — WHOIS lookups to identify registrar and registrant details
• Source code analysis — Downloading and de-obfuscating JavaScript to understand application logic
• Infrastructure mapping — Tracing tracking endpoints, analytics services, and hosting details
• Flow documentation — Reconstructing the victim journey from click to data collection
• Responsible reporting — Filing abuse reports with Cloudflare, registrar, and Nepal Cyber Bureau

Technical Analysis

Two-Domain Architecture

Domain	Purpose	Created
bigmartprizeq.com	Landing + mobile detection	August 15, 2026
bigmart-gift.com	Full phishing application	August 9, 2026

Mobile-Only Evasion

The landing page contains JavaScript that detects device type:

if (system.win || system.mac || screen.availWidth > screen.availHeight) {
    // Desktop → fake 404 page
    window.location.href = '/emit/404/p';
} else {
    // Mobile → actual phishing page
    window.location.href = 'https://bigmart-gift.com/...';
}

This hides the phishing content from desktop-based security scanners and researchers.

Phishing Application Flow

The bigmart-gift.com application implements a multi-stage flow:

1. Landing — Fake BigMart branding with confetti and prize box
2. Survey — Three questions to “claim” the prize
3. Share-to-continue — Must share to 5 WhatsApp groups/Telegram chats
4. Fake progress — Progress bar advances from 50% to 100%
5. Verification — Collects name and phone number
6. Payment — Collects bank details and OTP

Viral Spread Mechanism

The application includes built-in share functions for:

Platform	Mechanism
WhatsApp	api.whatsapp.com/send/?text=
Telegram	t.me/share/url?url=
Messenger	fb-messenger://share?link=
Line	line.me/R/share?text=
Viber	viber://forward?text=

Tracking Infrastructure

Service	URL	Purpose
ClickPoint	app.clickpoint.top/hm.gif	Victim progress tracking
Baidu Analytics	hm.baidu.com/hm.js	Visitor analytics
Google Tag Manager	googletagmanager.com/gtag/js	Campaign tracking
Tanmi	img.tanmi.net	Conversion pixel

Victim Fingerprinting

Each visitor is assigned a unique fingerprint using FNV-1a hash and SplitMix64 random number generation, stored in localStorage for persistent tracking.

Fake Trust Elements

The application dynamically generates:

• Fake user reviews/comments
• Fake alert popups (SweetAlert2)
• Fake progress bars
• Fake countdown timers

Key Findings

Finding	Detail
Domains registered within days of campaign	Classic disposable phishing infrastructure
Registrar	West263 International Limited (Hong Kong)
Registrant location	An Hui Sheng, China (for bigmart-gift.com)
Hosting	Cloudflare (anonymizes real server)
Phishing kit version	v3.14 (mature, iterated framework)
Data collected	Name, phone, address, bank details, OTP

Security Impact

The campaign targets Nepali mobile users through platforms they trust. The share-to-continue mechanism makes victims unknowingly spread the phishing link to friends and family. The collection of banking details and OTP enables direct financial theft.

Recommendations

1. Block both domains at ISP level
2. Monitor for replacement domains — the kit version suggests rapid re-deployment
3. Public awareness — warn users about “BigMart Prize” messages
4. Investigate ClickPoint — the shared tracking backend may serve multiple campaigns

Disclosure

Abuse reports were filed with:

• Cloudflare (report #23412994)
• West263 International Limited (registrar)
• Nepal Police Cyber Bureau