cyber.hendryadrian.com
Threat Research · cloudsek.com

CloudSek Details Holiday Fake-Store Networks Harvesting Shoppers’ Payment Data

· Original article ↗

Summary

CloudSek describes two clusters of holiday-themed fake stores that impersonate consumer brands, reuse shared templates, and harvest billing and payment details. More than 750 domains were linked in one cluster; over 200,000 .shop results were potential matches, not all-

Key points

  • One cluster contains more than 750 interconnected sites, many with Amazon-themed typosquatting, that reuse holiday banners, urgency messages, and misleading trust indicators.
  • A second cluster uses recurring Black Friday templates across .shop domains impersonating many consumer brands; more than 200,000 FOFA results included active and historical domains and were not all confirmed malicious.
  • Shared CDN assets, HTML and JavaScript templates, favicon hashes, and infrastructure were used to find and correlate potentially fraudulent storefronts.
  • Checkout flows can collect billing, personal, and payment-card details; some sites redirect transactions through shell merchant websites.
  • The operators use countdowns, fake trust badges, fabricated purchase pop-ups, and steep discounts to pressure shoppers into buying.
  • Some identified domains were taken down, while others remained active or launched as the holiday sales period approached.
  • The report advises shoppers to verify deals through official brand websites and be wary of lookalike domains, recently registered sites, and repeated storefront designs.

Article Details

Attack Vectors
  • Fake holiday storefronts use brand-mimicking or typosquatted domains, steep discounts, urgency banners, fake trust badges, and fabricated purchase pop-ups to induce purchases.
  • Checkout pages collect billing, credit-card, and personal information; the article says some details are embedded in URL parameters and sent to attacker servers.
  • A shell merchant domain is reported to redirect payments from a fake store to PayPal or card transactions, facilitating fraudulent transactions.
  • The precise victim-distribution methods are undetermined. The article presents messaging apps, private social-media sharing, paid ads, SEO abuse, phishing email or SMS, and redirect chains as possible methods, not confirmed activity.
  • The storefronts reuse holiday-themed templates and JavaScript, and some sites are reported to use Cloudflare reverse proxies to conceal origin infrastructure.
Defensive Notes
  • Avoid unfamiliar stores using unusually low prices, urgent countdowns, fake certification badges, or recent-purchase pop-ups.
  • Check for brand names combined with extra words such as safe, fast, deal, sale, or us, and for recently created domains or identical layouts across different stores.
  • Verify offers directly on the brand’s official website and avoid entering payment details on suspicious storefronts.

Indicators of compromise

TypeIndicatorContext
DOMAIN8bitdosafe[.]shopListed as a potentially fake storefront impersonating 8BitDo.
DOMAINaetnasafe[.]shopListed as a potentially fake storefront impersonating Aetna.
DOMAINahavasafe[.]shopListed as a potentially fake storefront impersonating Ahava.
DOMAINaiwasafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINakitassafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINakkosafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINalintorsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINallegracesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINallterrainsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINalovesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINalpakaonline[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINalpensattelus[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINamaboxreturns[.]comFake storefront reported to redirect payments through a shell merchant domain.
DOMAINamazfitsafe[.]shopListed as a potentially fake active storefront.
DOMAINamazonamazonbasicsonline[.]shopListed as a potentially fake active storefront impersonating Amazon Basics.
DOMAINamazonshome[.]comListed as a potentially impersonating fake-store domain in the first cluster.
DOMAINamdsafe[.]shopListed as a potentially fake storefront impersonating AMD.
DOMAINamericansafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINappleipadus[.]shopListed as a potentially fake storefront impersonating Apple.
DOMAINapremiumsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINaqarasafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINaquafreshsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINarmitronsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINarrissafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINarussafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINascotsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINaspectsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINastroaisafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINatarisafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINatasus[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINatomysafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINatoztreasure[.]comFake storefront identified as an entry point to the first suspicious cluster.
DOMAINatuvossafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINavantreesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINavedasafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINavengerssafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINawarasafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINayeshasafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbabygosafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbabylisssafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbabymoovsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbadensafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbadusafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbahcosafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbalancesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbanquetfast[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbanquetusabst[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbarberbosssafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbarcosafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbarneysafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbaronsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbboxsalede[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbcwsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbeelinksafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbellavitasafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbenadrylsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbenfeisafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINberkshirestore[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbernysafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbesteksafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbestronsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbestwaysafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbett1safe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbeyerdynamicsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbhcosmeticssafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbianyosafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbiggamesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbiibsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbillblasssafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbilliesales[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbillieusbst[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbionairestore[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbizzysafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINblackburnsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINblackbutterflysafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINblackflagsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINblackstonesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINblindscontrol[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINblinksafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINblossomsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINblueboxstore[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbluemoonsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINblueorangesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbluepetsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbluettisafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbluewavesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbluntsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINboaosafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbodegasafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbodhisafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbodisafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbodyguardsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbonessafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbonidesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbonsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbontecsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINborosafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINboxercraftsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbradleysafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbravensafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbrennenstuhlsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbricosafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbridgestonesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbrpsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbrynsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbsnsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbtfbmsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbublysafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbubssafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbuglessaleus[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbulovasafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbuoysafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINburstsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbusybeesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbusysafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbutterfingersafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbwesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINbybenyarsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINcamechosafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINcapturesafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINcareallsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINcarnivalsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINcartmansafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINcdn[.]cloud360[.]topShared suspicious resource host serving holiday assets and templates used by the first fake-store cluster.
DOMAINciscosafe[.]shopListed as a potentially fake storefront impersonating Cisco.
DOMAINcosrxus[.]shopListed as a potentially fake active storefront impersonating COSRX.
DOMAINdellasafe[.]shopListed as a potentially fake storefront impersonating Dell.
DOMAINdiadorasafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINfiiosafe[.]shopListed as a potentially fake storefront impersonating Fiio.
DOMAINfujifilmsafe[.]shopListed as a potentially fake active storefront impersonating Fujifilm.
DOMAINfujitsusafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINgarminsafe[.]shopListed as a potentially fake active storefront impersonating Garmin.
DOMAINgeorgmat[.]comShell merchant domain used for payment redirection from a fake store and linked to fraudulent transactions.
DOMAINgotraxsafe[.]shopListed as a potentially fake storefront impersonating Gotrax.
DOMAINhpksafe[.]shopListed as a potentially fake active storefront impersonating HP.
DOMAINjomalonesafe[.]shopListed as a potentially fake active storefront impersonating Jo Malone.
DOMAINkenwoodsafe[.]shopListed as a potentially fake active storefront impersonating Kenwood.
DOMAINlogitechsafe[.]shopListed as a potentially fake storefront impersonating Logitech.
DOMAINmeetionsafe[.]shopListed as a potentially fake storefront impersonating Meetion.
DOMAINniveamensafe[.]shopListed as a potentially fake storefront impersonating Nivea Men.
DOMAINolympussafe[.]shopListed as a potentially fake storefront impersonating Olympus.
DOMAINomronsafe[.]shopListed as a potentially fake active storefront impersonating Omron.
DOMAINpaulaschoicefast[.]shopListed as a potentially fake storefront impersonating Paula’s Choice.
DOMAINrarebeautysafe[.]shopListed as a potentially fake storefront impersonating Rare Beauty.
DOMAINraybansafe[.]shopListed as a potentially fake storefront impersonating Ray-Ban.
DOMAINsamsungsafe[.]shopListed as a potentially fake active storefront impersonating Samsung.
DOMAINseagatesafe[.]shopListed as a potentially fake active storefront impersonating Seagate.
DOMAINsharksafe[.]shopListed as a potentially fake active storefront impersonating Shark.
DOMAINskhynixsafe[.]shopListed as a potentially fake storefront impersonating SK Hynix.
DOMAINsnapplesales[.]shopListed as a potentially fake storefront impersonating Snapple.
DOMAINsunnysideupbakerysale[.]shopInitial fake-store domain identified as the entry point to the second cluster.
DOMAINtimhortonssafe[.]shopListed as a potentially fake storefront impersonating Tim Hortons.
DOMAINtoshibafast[.]shopListed as a potentially fake storefront impersonating Toshiba.
DOMAINviomisafe[.]shopListed as a potentially fake storefront impersonating Viomi.
DOMAINwesterndigitalsafe[.]shopListed among potentially fake storefront domains in the second cluster.
DOMAINxiaomidea[.]shopListed as a potentially fake storefront impersonating Xiaomi.
DOMAINyalesafe[.]shopListed as a potentially fake storefront impersonating Yale.
HOSTNAMEwww[.]amaboxhub[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaboxmarket[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaboxmarketplus[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaboxmarkets[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaboxpallet[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amabxestore[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amafastsale[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaluckybox[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaluckybx[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amanpalets[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amanwarehouse[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amapalettes[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amapalletmarket[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amapalletmarkets[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amapalletsales[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amapalletsreturn[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amastorages[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amasuprisepallet[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amawarehousebox[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amawarehousesale[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amawarehousex[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amawhsepallets[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaxboxsalex[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amazboxde[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amazgeheimnisbox[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amazhotsales[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaznboxsaleus[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaznbxstore[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaznsalepallets[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaznsbigsale[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaznshop[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amaznsliquidation[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amazonpalletrush[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amazonreturnsbox[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amazpalette[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amazpalletsgift[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amazrpallets[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amazsaleboxus[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amazsalepalletus[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amazusboxes[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amazxpallets[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amzelectronicbox[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amzglobalpallets[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amzliquidationpallet[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amznbigsale[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amznboxsales[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amznpallet[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amznpalletmarket[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amznreturnsale[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amznsmysterybox[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amzonboxshop[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amzonpaletten[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amzpaletten[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amzpalletliquidation[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amzreturenbox[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amzreturn[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]amzreturnpallet[.]comListed as a potentially impersonating fake-store domain in the first cluster.
HOSTNAMEwww[.]georgmat[.]comListed as a shell website associated with the fake-store payment operation.
HOSTNAMEwww[.]hiwoji[.]comListed as a shell website associated with the fake-store payment operation.
HOSTNAMEwww[.]howokin[.]comListed as a shell website associated with the fake-store payment operation.
HOSTNAMEwww[.]hwujo[.]comListed as a shell website associated with the fake-store payment operation.
HOSTNAMEwww[.]kinwony[.]comListed as a shell website associated with the fake-store payment operation.
HOSTNAMEwww[.]loyoyi[.]comListed as a shell website associated with the fake-store payment operation.
HOSTNAMEwww[.]pasony[.]comListed as a shell website associated with the fake-store payment operation.
HOSTNAMEwww[.]qinsony[.]comListed as a shell website associated with the fake-store payment operation.
HOSTNAMEwww[.]qiotong[.]comListed as a shell website associated with the fake-store payment operation.
HOSTNAMEwww[.]sintayo[.]comListed as a shell website associated with the fake-store payment operation.
HOSTNAMEwww[.]thewonsel[.]comListed as a shell website associated with the fake-store payment operation.
HOSTNAMEwww[.]tisuny[.]comListed as a shell website associated with the fake-store payment operation.
SHA256095a3ebc77f4e46b3adda543b61d90b7d3f20b41532c07772edd31908d060bb2SHA-256 body hash of the recurring JavaScript template associated with fraudulent checkout operations on the suspicious .shop sites.

Vendors

Alibaba CloudWHOIS records for georgmat[.]com indicate hosting through a China-based provider (Alibaba Cloud Computing Ltd.) with registration details listing Guangdong as the administrative state. The geographic mismatch betweenCloudflarea high majority of the potentially fake domains from the second cluster are being reverse proxied via CloudFlare Server which assists in concealing origin IP and core infrastructure of the threat actors hosting such

Tools

CloudSEK PlatformLeveraging The CloudSEK PlatformFOFAbanners for events such as Black Friday, Cyber Monday, Christmas, and Thanksgiving. When combined with FOFA searches for matching Amazon favicon hashes, this pattern provided an additional way to surface potentialVirusTotalthrough georgmat[.]com - a domain that remains unflagged on security reputation platforms such as VirusTotal - enabling the attacker to complete fraudulent financial transactions without immediately triggering

Countries

ChinaWHOIS records for georgmat[.]com indicate hosting through a China-based provider (Alibaba Cloud Computing Ltd.) with registration details listing Guangdong as the administrative state. The geographic mismatch between

Industries

E-commerceFraudulent checkout flows harvest sensitive billing and financial information, facilitating unauthorized transactions through fake e-commerce sitesFinancial ServicesRetailas the administrative state. The geographic mismatch between the infrastructure and the impersonated U.S. retail brands increases suspicion and supports the assessment that the domain is being leveraged as part of a

Related Articles