Massive Phishing Campaign Uses 6,000 Sites

Bolster’s threat research team recently discovered an extensive brand impersonation effort targeting more than 100 well-known clothes, footwear, and apparel firms.

The peak phishing activity for this campaign occurred between November 2022 and February 2023, after becoming active around June 2022.  

Nike, Puma, Asics, Vans, Adidas, Columbia, Superdry Converse, Casio, Timberland, Salomon, Crocs, Sketchers, The North Face, UGG, Guess, Caterpillar, New Balance, Fila, Doc Martens, Reebok, Tommy Hilfiger, and countless more well-known companies are among those impacted by this campaign.

A massive network of brand imitation scam websites with over 3,000 domains and around 6,000 sites, including inactive ones, was discovered via investigation.

Specifics of the Massive Phishing Campaign

Researchers say this campaign domains linked to this fraud may be linked to the autonomous system with the number AS48950. 

Two specialized internet service providers, Packet Exchange Limited and Global Colocation Limited, host the IP addresses for these domains.

It’s important to remember that both suppliers have a bad reputation for being vulnerable to scams.

The average domain age is between two and 90 days, and the majority are registered through Alibaba.com Singapore.

“In their attempts to deceive, the attackers predominantly utilize a pattern of combining the brand name with a random country name, followed by a generic top-level domain (TLD),” explains the Bolster’s threat research team.

Examples of Puma-targeting domains include puma-shoes-singapore[.]com, pumaenmexico[.]com.mx, bestpumaindia[.]in, and much more.

Domain aging is an important component in phishing operations since the longer a domain is active yet harmless, the less likely it is to be identified as suspicious by security systems.

Confiant noted last year that a domain should be allowed to age for at least two years after spotting the strategy being used successfully by a global malvertising operation since 2018.

Many of the malicious sites in the Bolster-found campaign persisted long enough without being detected that Google Search crawled them, and they now probably score highly for particular search phrases.

“Attackers are employing various search engine optimization (SEO) techniques to manipulate search engine rankings and increase visibility”, researchers.

Customers who fail to recognize that these websites are not official brand sites frequently fall for the trap.

They willingly expose their personal information when they input their email, password, and payment card information.

 Even worse, some of these imitation websites are ranked highly in search engine results, which makes it simpler for victims to go upon them and believe them to be trustworthy unintentionally.

Recommendation

• Users should take care to confirm the legitimacy of websites, especially when dealing with well-known brands.
• Watch out for any indications of a questionable domain name. 
• You should go above and above to confirm the integrity of the site if you come across a deal or product pricing that looks too good to be true.

Looking For an All-in-One Multi-OS Patch Management Platform – Try Patch Manager Plus