Wrote: Etrit Rexhepi
Two pieces of content have been published claiming that fashion company ZARA is removing clothes from last year's collections to "recycle" them and that users can get a box of clothes for free or at a reduced price. All of this can happen by filling out a 3-question questionnaire.
This content was published on March 16 on Facebook, by a page called “Fashion in Kosovo” (see here and here).
What's wrong with this content?
Hibrid.info has noticed that these posts may be forms of online fraud.
The page that published this content has over 360 followers. Its posts feature comments from users who show interest in the offer, and in some cases they even receive responses from the publisher himself.
However, what makes this content suspicious is the fact that, although the comments are in Albanian, the names and surnames of the accounts commenting are foreign and do not look like typical Albanian names.
The language used in these comments, although in Albanian, does not belong to the usual conversational style used in Kosovo, suggesting that they may have been automatically translated or not written by authentic speakers of the language.
To obtain more information about the contents, the "Learn more" button was clicked, after which a page was opened.
The page is presented as a ZARA offer and features their logo, the product "ZARA MYSTERY BOX" priced at around €9.99, and photos of several boxes bearing the ZARA logo.
An order button, such as “Buy” or “Add to cart”, is visible, while below it appears a section with very positive ratings and comments from users that also include photos of boxes and clothes. At the bottom of the page are social media icons and a QR code.
The URL of the site is “zenvarisapp.shop”.
Photo of the open page:
Hibrid.info found that the official URL of this company is "zara.com" (see here). While the official website for Kosovo is “zara.com/xk/” (see here).
There is no data on this page about the alleged offer.
Next, they continued filling out the questions. After answering the questions, a new page opened, showing images with boxes, which they were suggested to try, by clicking on them, to become part of the claimed opportunity.
After trying on three different boxes, a small window appears, stating that you have won the "Zara Mystery Box" and asking you to fill out the form and make the payment to receive the box.
Then, the window for filling in personal data opened, which was filled in with fictitious data.
After filling in the form, the payment window opened. Due to the possibility of financial fraud, this payment was not processed further.
Due to these suspicions, a website analysis service called urlscan.io was used to check and found that the domain “zenvarisapp.shop” is only 24 days old and operates through Cloudflare’s infrastructure. The scan initially showed a “502 Bad Gateway” message, while the page remains active for users, promoting attractive offers on behalf of the Zara brand. This could be a technique used to mask the real content from automated bots.
This tool also showed that the traffic comes targeted through specific advertising campaigns (UTM), confirming the discrepancy between what the server reports during the security check and what the visitor sees on the screen.
Low reliability (25%) for this URL was also shown in the analysis results from another online service “ScamDoc.com” (see here).
Hibrid.info has found content in Dutch and Slovenian, where the same images were used to publish the same claim in these countries, on behalf of the company "Zara" (see here and here).
Analyze:
The claim that ZARA offers a "ZARA Mystery Box" with free or low-priced clothes is not accurate.
The page that published this post seems suspicious because many indicators do not match an official or authentic page. The names and comments of the users do not seem authentic and do not reflect the usual style of communication in Kosovo, while the language used is often not natural.
Additionally, the same images have been used in other places to promote the same claim, indicating that this could be a more widespread scam. Also, the credibility of the linked page in the post is very low, confirming that the offer cannot be taken as safe.
Therefore, based on the working methodology, hibrid.info assesses the content as "Fraud".
Reasoning:
The “Deception” rating is given to informational content that is manipulated in terms of visual (deepfake, cheapfake), audio, or textual content to deceive the audience. This form of deception is usually used to produce false and manipulated content.