A widespread brand impersonation campaign targeting over a hundred popular apparel, footwear, and clothing brands has been underway since June 2022, tricking people into entering their account credentials and financial information on fake websites.
The brands impersonated by the phony sites include Nike, Puma, Asics, Vans, Adidas, Columbia, Superdry Converse, Casio, Timberland, Salomon, Crocs, Sketchers, The North Face, UGG, Guess, Caterpillar, New Balance, Fila, Doc Martens, Reebok, Tommy Hilfiger, and others.
According to Bolster’s threat research team, who discovered the campaign, it relies on at least 3,000 domains and roughly 6,000 sites, including inactive ones.
Bolster reports that the campaign had a significant activity spike between January and February 2023, adding 300 new fake sites monthly.
The domain names follow a pattern of using the brand name together with a city or country, followed by a generic TLD such as “.com.”
The researchers say that the campaign operated over ten fake websites for Nike, Puma, and Clarks, featuring a design very similar to the official sites of the brands.
These scam domains were traced back to the Autonomous System number AS48950 and were hosted by two internet service providers, Packet Exchange Limited and Global Colocation Limited.
Most are registered through Alibaba.com Singapore, and the domain age ranges between two years and 90 days.
Domain aging is a crucial factor in phishing operations, as the longer a domain stays alive but remains innocuous, the less likely it is to be flagged by security tools as suspicious.
Letting a domain age for at least two years is something that Confiant reported last year, observing the tactic in a global malvertising campaign that has been using it successfully since 2018.
In the campaign discovered by Bolster, many of the malicious domains survived so long without being reported that Google Search indexed them and are now likely to rank high for specific search terms.
This is a particularly effective strategy in luring unsuspecting users to visit a phishing site, as most people associate high ranking in Google Search with credibility and trustworthiness.
(BleepingComputer)
BleepingComputer navigated pages on some of these sites and found that they’re not hastily built clones, as they feature realistic “About Us” pages, include contact details, the order pages work as expected, and are generally tricky to identify as suspicious.
The exact scam strategy followed in this campaign is unknown, but Bolster suggests that the sites either never ship the products customers pay for or ship Chinese knockoffs.
Additionally, any details entered on the checkout pages, most notably the credit card details, may be stored by the website operators and resold to cyber criminals.
When searching for the official website of a brand, skip all promoted results on Google Search. If still unsure, check the brand’s Wikipedia page or social media channels for the legitimate URL.