AliExpress Impersonation Emails Are Reaching Your Inbox With Fake Summer Discount Offers

Emails of this nature are designed to lure your staff into clicking links embedded within promotional content, with the likely objective of harvesting credentials, delivering malware, or redirecting recipients to fraudulent storefronts. The financial and reputational harm to your organisation can be significant — particularly where staff interact with the content on work devices or enter personal and payment details into spoofed landing pages. Even a single click on an unverified link can provide an initial foothold for a broader compromise.

This campaign was identified after a spike in NZ inboxes, with the same message appearing across multiple local organisations within a narrow window. The emails present as promotional communications from AliExpress, advertising a summer sale with a 60% discount offer. The concentrated delivery timeframe suggests an automated bulk-sending operation rather than a targeted or manually curated campaign.

The deception lies in the mismatch between the claimed sender identity and the actual sending infrastructure. While the display name references AliExpress, the sending domain — shoppingbestof.shop — has no affiliation with the legitimate AliExpress platform. Critically, the message fails all standard email authentication checks: SPF returned no result, DKIM failed, DMARC returned no result, and composite authentication failed entirely. A legitimate communication from a major e-commerce platform would pass these checks without exception.

Of note is the unsubscribe mechanism embedded in the HTML body, which invites recipients to "click here to remove your self from our emails list" — a construction that is grammatically irregular and inconsistent with professional marketing communications. Rather than providing a genuine opt-out, such links are frequently used to confirm active email addresses to threat actors, or to redirect recipients through additional malicious infrastructure. The campaign's use of seasonal framing — referencing summer deals — is also contextually inverted for New Zealand's July winter, suggesting the content was repurposed from a Northern Hemisphere template with no localisation applied.