Compromised Websites Funnel World Cup Shoppers to Purchase Scams
Summary
Recorded Future describes scammers compromising legitimate websites to redirect search visitors to unindexed purchase-scam domains. The tactic uses cloaking, rotating domains, and multiple merchant accounts, and is appearing in World Cup-themed fraud.
Key points
- Scammers compromise legitimate websites and add fake product listings and metadata that search engines can index.
- Injected code redirects visitors arriving from search results to scam domains, while regular visitors and site administrators see the legitimate site.
- The scam domains themselves are not indexed, and operators rotate domains, branding, and merchant accounts to make detection and disruption harder.
- Recorded Future linked 41 AEGIR scam domains to three merchant accounts; the domains had about 26 million visits, including 17 million in 2026.
- A shared image hash pointed to roughly 1,714 additional sites potentially tied to the same operation.
- Payments may be laundered through merchant accounts using misused or compromised business identities; consumers can lose money and have payment-card data stolen.
- Recorded Future identifies referrer-based cloaking, domain rotation, and unusual merchant descriptors as defensive signals. It also reported 33 World Cup-themed scam domains linked to about 2,500 online ads in April and May 2026.
Article Details
- Attack Vectors
- Compromise legitimate websites, then inject fake product listings and search metadata to attract organic search traffic.
- Use referrer-based cloaking: injected code redirects visitors arriving from search results with a specific tracking parameter to scam domains, while regular visitors and site administrators see the legitimate site.
- Use social media ads to direct victims to World Cup-themed scam domains.
- Present discounted or impersonated goods, take payment without shipping the products, and steal customers’ payment card data.
- Rotate scam domains, branding, and content; reuse merchant accounts and misuse or compromise business identities to process payments and evade disruption.
- Defensive Notes
- Monitor for search-referrer-based redirects and cloaking, domain rotation, and anomalies in merchant descriptors.
- Correlate scam domains with merchant accounts and other underlying infrastructure to identify connected activity and support early disruption.
- The article notes that scam domains may not be indexed by search engines, while only compromised pages are indexed; standard search monitoring may therefore miss the payment-taking infrastructure.