← Hooked Scams

INTERCEPT CELL RESEARCH / HOOKED SCAMS · CASE 002

Case 002: snapbargainhub.com

A fake Lowe's Kobalt prize email, five redirect hops, and a checkout that bills you three times.

This case has two reads: a plain-language version for people who may have been contacted by the scam, and a technical readout for investigators and analysts.

This case file is about a fake Lowe's® "you won a Kobalt toolset" email that leads to a checkout site called snapbargainhub.com. The site is still live as we write this. It is not a Lowe's website. It is a subscription trap: a small upfront charge, then hidden monthly memberships buried in the terms.

Victim Readout

You got an email saying you won a Kobalt toolset from Lowe's

If that sounds familiar, here is what was probably going on.

The email

The message claims to be from Lowe's®. The subject line looks like a date stamp — for example, Lowe's - Tue,30 Jun-2026. The body shouts that you are a winner and offers a Kobalt tool set from Lowe's. There is a blue button: Claim Your Reward. A fake expiration date adds urgency.

Fake Lowe's prize email: YOU ARE OUR WINNER Kobalt Tool Set from Lowe's, Claim Your Reward button, expiry Tue 30 Jun 2026

This is not from Lowe's. Real Lowe's marketing comes from @lowes.com addresses, uses real branding and footers, and does not ask you to "claim a reward" through a random link. The sender address in this campaign used a nonsense domain like @xmmyb2.us with a long random username — a classic throwaway spam pattern.

What happens when you click

The link does not go straight to a store. It bounces through several hidden hops — often starting on Google Cloud Storage, then a redirector domain, then a tracking/cloaker site, then an affiliate link — before landing on snapbargainhub.com.

That checkout page shows a Kobalt toolset "sweepstakes" with a countdown timer. It asks for your name, address, and credit card. The page may offer a fake "Mastercard discount." It feels like you are paying a small shipping or entry fee ($11.95–$14.95).

That is the hook. The real damage is in the fine print.

The hidden charges

If you enter your card, you are not just paying once. The terms (which almost nobody reads) enroll you in:

  1. An upfront "entry fee" — about $11.95 (Mastercard) or $14.95 (Visa/Discover).
  2. A "Discount Consumer Saving" membership — about $73–$76 per month, billed every 30 days.
  3. A "complimentary fitness app" trial — free for 45 days, then recurring monthly billing if you do not cancel.

You do not get a Kobalt toolset shipped to your door in any normal retail sense. The "you won" language is theater. The business model is recurring billing on your card.

Red flags

  • Email says Lowe's but the sender address is not @lowes.com.
  • "You won" something valuable for answering a few questions — no real retailer runs giveaways this way by email.
  • Urgent expiration date in the message (often already passed).
  • Checkout on a domain you have never heard of (snapbargainhub.com), not lowes.com.
  • Small upfront fee with dense terms linking to memberships and fitness apps.
  • Support phone 877-769-3140 that is hard to reach or unhelpful for cancellations.

What to do if you clicked or paid

  1. If you only clicked and did not enter a card: You are probably fine. Delete the email, block the sender, do not click again.
  2. If you entered card details: Call your bank or card issuer today. Say you were enrolled in unauthorized recurring charges from an online "sweepstakes" checkout. Ask for a fraud dispute and to block future charges from that merchant.
  3. Do not trust "cancel" links in follow-up emails. Scammers often send fake tracking or refund links for a second bite.
  4. Report the phishing email to your mail provider (Report phishing / Report spam). In the US you can also forward to reportphishing@apwg.org and file at reportfraud.ftc.gov.
  5. Tell someone you trust. Shame keeps people from acting quickly; acting quickly is what limits the damage.

What to tell someone else

If a parent, spouse, or coworker shows you this email, ask:

  1. "Did you click Claim Your Reward?"
  2. "Did you type in a credit card?"
  3. "Is the sender actually @lowes.com?"

If they entered a card, treat it as a billing emergency — not a lecture.

This is not just one email

The same checkout kit has been seen with different product skins (Kobalt tools, iPad Pro, coolers). The Lowe's + Kobalt angle is one lure. The mechanics — fake prize, hidden subscriptions — are the same.

If something like this happened to you, contact us or share this page with someone who needs a faster warning than they got in their inbox.

Need a scam, impersonation, or fraud infrastructure investigation? Cipher Cortex provides fixed-scope investigation support for organizations, executives, legal teams, and security teams.

Request a Briefing