Over 2,000 Fake Shopping Sites Spotted Before Cyber Monday

The fake sites were identified by their suspicious resource usage and recurring templates. This operation includes two main groups: one with over 750 interconnected sites, 170 of which impersonate Amazon using uniform banners, flipclock-style urgency timers, and misleading trust symbols. The second group comprises over 1,000 .shop domains impersonating major brands like Apple, Samsung, Dell, Ray-Ban, and Xiaomi.

The sites are linked because they all load their designs from the same shared source, like a digital fingerprint, which allowed CloudSEK to trace these stores back to a single criminal group. The sites are spread through social media ads, search results, and messaging apps like WhatsApp and Telegram.

Researchers explain that once a shopper decides to buy, they are sent to a shell checkout page, which looks like a standard payment screen but is actually designed to steal sensitive financial details. For example, the domain amaboxreturns.com redirects payment through another unflagged domain, allowing criminals to complete fraudulent transactions without raising alarms. CloudSEK noted that these payment portals often use a China-based provider for hosting.

“WHOIS records for georgmat.com indicate hosting through a China-based provider (Alibaba Cloud Computing Ltd.) with registration details listing Guangdong as the administrative state. The geographic mismatch between the infrastructure and the impersonated US retail brands increases suspicion and supports the assessment that the domain is being leveraged as part of a fraudulent, holiday-themed payment redirection scheme,” the blog post reads.

To read the complete article see: Hackread Article.