We discovered a novel spam campaign over the weekend, targeting fans of John Wick on the Amazon Kindle store. The scam itself involves paying for what appears to be the upcoming third movie, turns into a bogus ebook, and goes on to hyperlink potential victims to a collection of third-party websites.
How does this begin?
With a dog, a grieving assassin, and a pencil.
Actually, it begins with me hunting for John Wick graphic novels on the Kindle store. What I found isn’t exactly hidden from view—as you can see from the screenshots, the bogus results kick in right under the second genuine entry:
Click to enlarge
What are we looking at here?
Roughly 40 or so individual items uploaded from around January 25 to February 2, each one from a different “author.” At first glance, you might think you’re looking at movies, thanks to the play button icon on each image preview. The fact that each entry is called something along the lines of “John Wick 3: free movie HD” probably helps, too.
Click to Enlarge
All of the items are on sale for a variety of prices including £0.99 each, £9.93, £12.19, and up to an astonishing £15.25 (roughly $20 USD). A few of them are listed as free, and all of them have a preview available.
Click to enlarge
At this point, someone seeing this may think they’re actually buying a copy of John Wick 3. This is where it gets interesting.
This isn’t John Wick 3, is it?
Correct, it absolutely is not John Wick 3. What we have here is an incredibly basic ebook with a “play movie” image bolted onto the preview. Opening up the preview gives us a slice of “coming soon” style text for the movie, due out in May.
The text reads as follows, and appears to be the same content used in each ebook:
John Wick: Chapter 3 – Parabellum
When we last observed John Wick, he wasn’t in the best shape as he’d quite recently had a worldwide contract hit put out on him toward the finish of John Wick: Chapter 2.
So most would agree that the third motion picture in the hit activity establishment, driven by Keanu Reeves, won’t be a steady walk around the recreation center. Indeed, even the full title, John Wick:
Chapter 3 – Parabellum, insights at the massacre in store as Reeves clarified recently.
“[It means] get ready for war. It’s a piece of that popular sentence, ‘Si vis pacem, para bellum’ which interprets as, ‘On the off chance that you need harmony, get ready for war’,” he laid out. All things considered, Wick said he’d “execute them all” toward the finish of Chapter 2.
Looking at the “Click here” text isn’t useful on a mobile device, because in practice I couldn’t get it to recognise my clicks. I also couldn’t figure out what the clickable link was from looking at it on the mobile, either. With that in mind, it was time to port over to a desktop and fire up an appropriate reader.
A quick port to a desktop reader later, and we now have a fully clickable link:
Click to enlarge
Where does the link go?
It takes would-be Wick watchers to:
Livemovie(dot)xyz/play(dot)php?movie=458156
Which is a portal that claims to offer up multiple movies:
Click to enlarge
The movie we’re interested in here is John Wick 3:
Click to enlarge
No matter what you do at this point, the only option here is “be forwarded to another site” via the register button:
Click to enlarge
Our tour of the movie world upside-down now takes us to:
Flowerfun(dot)net/en/html/sf/registration/eone.html
Click to enlarge
This style of site may be familiar to regular readers. They typically claim to offer all sorts of media content and claim free sign ups, but there’s usually a rolling charge or fees somewhere in the mix. The site says the following:
You agree that, on registration for a Membership, you authorise us to place a pre-authorisation hold (between USD $1.00 to 2.00) on your Payment Card to validate your billing address and other Payment Card information.
Depending on your region, you may find yourself sent to similar sites like:
signup(dot)lymemedia(dot)net
Click to enlarge
However, there is no further information in the T&C or Privacy Policy for either site that states exactly what sort of payment is (or isn’t) expected after signing up. One thing is for certain: Someone wasting up to £15 on a bogus ebook then bouncing from site to site isn’t going to end up with a legitimate version of John Wick 3.
Don’t set him off
It’s tricky to flag dubious content on the Kindle store, as you have to report each title individually and give reasons. We contacted Amazon customer support and have been informed these ebooks have been escalated to the appropriate teams.
Amazon has had problems with fake ebooks before, though those were in the business of swiping author’s content and making as much money as possible before being shut down. What we have here are worthless ebooks with no content, save for clickthrough links to streaming portals. At time of writing, the ebooks we discovered are still available for purchase [UPDATE, 5th Feb: we’ve not heard back from Amazon, although all of the dubious ebooks now appear to have been removed].
If you’re on the hunt for John Wick, the lesson is clear: don’t bring an ebook to a gunfight.
https://blog.malwarebytes.com/cybercrime/2019/02/bogus-john-wick-3-ebooks/