PrizeHand affiliate fraud kit

A prize or parcel claim starts the handoff

PrizeHand impersonates retailers and parcel delivery services. A retained prize page announces an air-fryer winner, asks for delivery preferences and presents a discounted product offer. A parcel page shows a tracking form followed by a failed-delivery notice and a button to update the recipient's details.

The pages personalize those claims with details already in the link. The script reads e, fn and ln for the visitor's email, first name and last name, then fills matching elements on the page. Both lures use the same destination decoder and continue-link builder.

The destination travels in the link

The dd parameter carries the encoded handoff host. PrizeHand converts URL-safe Base64 to ordinary Base64, decodes it and XORs each byte with a secret value plus that byte's position. The result becomes the HTTPS address in the buyLink anchor.

The link forwards e, fn, ln, app_vl and z when they are present. A retained parcel page falls back to sendung[.]paket-tracker[.]info/campaign/, with tracking placeholders named p1 through p4. The script sets the continue button's destination when the page loads.

What we see

Month	New sites
September	250
October so far	83

Checking a PrizeHand page

Keep the original link with its query parameters and inspect the continue button's destination. Look for:

• prize, discounted-product or failed-delivery claims personalized from e, fn and ln
• a dd parameter decoded by decryptDomain
• a position-dependent XOR operation using SECRET_KEY + i
• an anchor with the id buyLink that receives the decoded host
• visitor details forwarded alongside app_vl and z
• a /campaign/ route with custom tracking placeholders

Remove the lure and its handoff configuration. Review hosting and deployment access and rotate those credentials.