Mass registration of fake online shops originates from China

A new campaign uses mass registration of fake online shop domains to impersonate legitimate retailers, facilitate financial fraud, and in certain instances, distribute malware through counterfeit checkout systems and redirect payloads. Identified by the research division of BforeAI, analysis of the campaign’s registration and DNS telemetry indicates a well-structured operation with distinct clusters, primarily originating from Chinese infrastructure providers and utilizing domain privacy services to obscure attribution. The research analyzed 244 domains registered this year and finds over 50 percent of the WHOIS entries use privacy-protection or redacted fields. West263 and Dynadot dominate among China-based registrants, both being previously flagged… [Continue Reading]