Saturday, April 13, 2024

Massive Phishing Campaign Uses 6,000 Sites to Mimic Popular Brands

Bolster’s threat research team recently discovered an extensive brand impersonation effort targeting over 100 well-known clothes, footwear, and apparel firms.

The peak phishing activity for this campaign occurred between November 2022 and February 2023, after becoming active around June 2022.  

Nike, Puma, Asics, Vans, Adidas, Columbia, Superdry Converse, Casio, Timberland, Salomon, Crocs, Sketchers, The North Face, UGG, Guess, Caterpillar, New Balance, Fila, Doc Martens, Reebok, Tommy Hilfiger, and countless more well-known companies are among those impacted by this campaign.

A massive network of brand imitation scam websites with over 3,000 domains and around 6,000 sites, including inactive ones, was discovered via investigation.

In this case, email security solutions like Trustifi stops advanced email threats targeting Your business emails with AI-Powered email security.

Specifics of the Massive Phishing Campaign

The campaign domains linked to this fraud may be linked to the autonomous system with the number AS48950. 

Researchers said that the two specialized internet service providers, Packet Exchange Limited and Global Colocation Limited, host the IP addresses for these domains.

It’s important to remember that both suppliers have a terrible reputation for being vulnerable to scams.

The average domain age is between two and 90 days, and most are registered through Singapore.

“In their attempts to deceive, the attackers predominantly utilize a pattern of combining the brand name with a random country name, followed by a generic top-level domain (TLD),” explains the Bolster’s threat research team.

Fraud potential

Examples of Puma-targeting domains include puma-shoes-singapore[.]com, pumaenmexico[.], bestpumaindia[.]in, and much more.

Domain aging is an essential component in phishing operations. The longer a domain is active yet harmless, the less likely it is to be identified as suspicious by security systems.

Confiant noted last year that a domain should be allowed to age for at least two years after spotting the strategy being used successfully by a global malvertising operation since 2018.

Many of the malicious sites in the Bolster-found campaign persisted long enough without being detected that Google Search crawled them, and they now probably score highly for particular search phrases.

“Attackers are employing various search engine optimization (SEO) techniques to manipulate search engine rankings and increase visibility”, researchers.

Site for Clarks coming up top in Google Search

Customers who fail to recognize that these websites are not official brand sites frequently fall for the trap.

They willingly expose their personal information when they input their email, password, and payment card information.

 Even worse, some of these imitation websites are ranked highly in search engine results, which makes it simpler for victims to go upon them and believe them to be trustworthy unintentionally.


  • Users should confirm the legitimacy of websites, especially when dealing with well-known brands.
  • Watch out for any indications of a questionable domain name. 
  • You should go above and above to confirm the site’s integrity if you encounter a deal or product pricing that looks too good.

Stop Advanced Email Threats That Target Your Business Email – Try AI-Powered Email Security


Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles