cyber.hendryadrian.com
Threat Research · malwarebytes.com

Researchers Map 20,000 Fake Shops Sharing 36 IP Addresses

· Original article ↗

Summary

Researchers linked more than 20,000 fake shops through shared Sellvia-powered WordPress templates and 36 IP addresses. The stores are described as harvesting payment and personal data; the article also offers consumer safety guidance.

Key points

  • Researchers identified a cluster of more than 20,000 fake shops sharing infrastructure and storefront patterns.
  • The shops used WordPress and Sellvia templates, with cosmetic variations on two base themes and reused product images.
  • The domains resolved to 36 IP addresses, with activity concentrated in ranges including 207.244.x.x and 23.105.x.x.
  • The article says fake shops collect payment details, billing addresses, and personal information for resale or identity fraud.
  • FraudWear and BogusBazaar are cited as examples of larger, industrialized fake-shop operations.
  • Suggested precautions include checking unfamiliar stores and independent reviews, using browser protection, and choosing credit or virtual cards.

Article Details

Attack Vectors
  • Fraudulent storefronts use copied e-commerce templates, product images, and brand-like presentation to impersonate legitimate retailers.
  • The shops use ads, search results, deep discounts, countdown timers, and stock warnings to draw in shoppers and pressure them to purchase.
  • Fake checkout pages collect payment credentials, billing addresses, and other personal information for resale or identity fraud.
Defensive Notes
  • Use browser protection to block known scam sites.
  • Check unfamiliar shop domains carefully, look for independent reviews, and be wary of deep discounts and copy-paste storefronts.
  • Avoid entering payment details on unfamiliar sites; prefer credit cards, virtual cards, or payment services that add protection.

Indicators of compromise

TypeIndicatorContext
IPV4108[.]59[.]1[.]151Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4108[.]59[.]12[.]118Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4108[.]59[.]14[.]13Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4108[.]59[.]8[.]97Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4108[.]62[.]0[.]220Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4108[.]62[.]116[.]82Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4108[.]62[.]117[.]45Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4162[.]210[.]195[.]105Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4162[.]210[.]195[.]113Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4162[.]210[.]198[.]37Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4162[.]210[.]199[.]12Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4162[.]210[.]199[.]183Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4162[.]210[.]199[.]235Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4192[.]96[.]200[.]81Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4198[.]7[.]58[.]168Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4198[.]7[.]58[.]87Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4199[.]115[.]115[.]2Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4207[.]244[.]102[.]13Identified as part of the shared IP infrastructure hosting fake-shop domains.
IPV4207[.]244[.]109[.]109Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4207[.]244[.]126[.]106Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4207[.]244[.]126[.]19Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4207[.]244[.]126[.]21Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4207[.]244[.]67[.]158Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4207[.]244[.]69[.]201Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4207[.]244[.]71[.]143Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4207[.]244[.]89[.]198Listed as an IP address in the infrastructure for the fake-shop operation.
IPV4207[.]244[.]91[.]203Listed as an IP address in the infrastructure for the fake-shop operation.
IPV423[.]105[.]160[.]43Listed as an IP address in the infrastructure for the fake-shop operation.
IPV423[.]105[.]172[.]14Listed as an IP address in the infrastructure for the fake-shop operation.
IPV423[.]105[.]8[.]15Identified as part of the shared IP infrastructure hosting fake-shop domains.
IPV423[.]105[.]8[.]17Listed as an IP address in the infrastructure for the fake-shop operation.
IPV423[.]105[.]8[.]19Listed as an IP address in the infrastructure for the fake-shop operation.
IPV423[.]82[.]11[.]26Listed as an IP address in the infrastructure for the fake-shop operation.
IPV423[.]82[.]13[.]161Listed as an IP address in the infrastructure for the fake-shop operation.
IPV423[.]82[.]13[.]34Listed as an IP address in the infrastructure for the fake-shop operation.
IPV45[.]79[.]69[.]45Listed as an IP address in the infrastructure for the fake-shop operation.

MITRE ATT&CK

T1056.003 · Web Portal CaptureFake-shop checkout pages collect shoppers' payment credentials and personal information.

Threat Actors

BogusBazaarAn investigation described BogusBazaar as a franchise-style fake-shop network whose core team maintained servers, payment processing, and templates while decentralized operators launched stores.FraudWearResearchers documented FraudWear as a coordinated campaign involving more than 30,000 fraudulent stores impersonating fashion brands.

Vendors

MalwarebytesDefensive guidance includes using browser protection (e.g., Malwarebytes Browser Guard), scrutinizing unfamiliar TLDs (.shop, .top, .store, .xyz), checking independent reviews, and using credit or virtual cards forSellviaMore than 20,000 fraudulent online stores—many running on Sellvia WordPress templates and concentrated on 36 IP addresses—were mapped as part of an industrialized scam ecosystem that harvests payment credentials and

Products

Malwarebytes Browser GuardDefensive guidance includes using browser protection (e.g., Malwarebytes Browser Guard), scrutinizing unfamiliar TLDs (.shop, .top, .store, .xyz), checking independent reviews, and using credit or virtual cards forMalwarebytes Premium SecurityAvailable with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.Malwarebytes Scam GuardIf something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard.SellviaMore than 20,000 fraudulent online stores—many running on Sellvia WordPress templates and concentrated on 36 IP addresses—were mapped as part of an industrialized scam ecosystem that harvests payment credentials andWordPressMore than 20,000 fraudulent online stores—many running on Sellvia WordPress templates and concentrated on 36 IP addresses—were mapped as part of an industrialized scam ecosystem that harvests payment credentials and

Industries

E-commerceResearchers identified a cluster of over 20,000 fake e-commerce domains that share identical storefront templates and resolve to just 36 IP addresses, demonstrating centralized infrastructure.

Related Articles