Bolster’s threat research team recently discovered an extensive brand impersonation effort targeting over 100 well-known clothes, footwear, and apparel firms.
The peak phishing activity for this campaign occurred between November 2022 and February 2023, after becoming active around June 2022.
.png "Massive Phishing Campaign Uses 6,000 Sites 1")
Nike, Puma, Asics, Vans, Adidas, Columbia, Superdry Converse, Casio, Timberland, Salomon, Crocs, Sketchers, The North Face, UGG, Guess, Caterpillar, New Balance, Fila, Doc Martens, Reebok, Tommy Hilfiger, and countless more well-known companies are among those impacted by this campaign.
A massive network of brand imitation scam websites with over 3,000 domains and around 6,000 sites, including inactive ones, was discovered via investigation.
In this case, email security solutions like Trustifi stops advanced email threats targeting Your business emails with AI-Powered email security.
Specifics of the Massive Phishing Campaign
The campaign domains linked to this fraud may be linked to the autonomous system with the number AS48950.
Researchers said that the two specialized internet service providers, Packet Exchange Limited and Global Colocation Limited, host the IP addresses for these domains.
It’s important to remember that both suppliers have a terrible reputation for being vulnerable to scams.
The average domain age is between two and 90 days, and most are registered through Alibaba.com Singapore.
“In their attempts to deceive, the attackers predominantly utilize a pattern of combining the brand name with a random country name, followed by a generic top-level domain (TLD),” explains the Bolster’s threat research team.
Examples of Puma-targeting domains include puma-shoes-singapore[.]com, pumaenmexico[.]com.mx, bestpumaindia[.]in, and much more.
Domain aging is an essential component in phishing operations. The longer a domain is active yet harmless, the less likely it is to be identified as suspicious by security systems.
Confiant noted last year that a domain should be allowed to age for at least two years after spotting the strategy being used successfully by a global malvertising operation since 2018.
Many of the malicious sites in the Bolster-found campaign persisted long enough without being detected that Google Search crawled them, and they now probably score highly for particular search phrases.
“Attackers are employing various search engine optimization (SEO) techniques to manipulate search engine rankings and increase visibility”, researchers.
Customers who fail to recognize that these websites are not official brand sites frequently fall for the trap.
They willingly expose their personal information when they input their email, password, and payment card information.
Even worse, some of these imitation websites are ranked highly in search engine results, which makes it simpler for victims to go upon them and believe them to be trustworthy unintentionally.
Recommendation
- Users should confirm the legitimacy of websites, especially when dealing with well-known brands.
- Watch out for any indications of a questionable domain name.
- You should go above and above to confirm the site’s integrity if you encounter a deal or product pricing that looks too good.