Researchers identify AliExpress-themed phishing campaign using disposable domains

According to Infosecurity Magazine, security researchers have uncovered a sophisticated phishing campaign that utilized 10 newly registered domains designed to mimic AliExpress, a popular online retail platform.

EfficientIP Research Labs identified potential .cyou domains on June 9 that were later registered and began resolving to IP addresses on July 2. These domains, each following a pattern of one digit and five lowercase letters, were used as entry points to a fake AliExpress phishing site. The domains were designed to be disposable, with each redirecting visitors through a tracking layer that allowed operators to swap out exposed domains without rebuilding the campaign. This tactic circumvents reputation-based security controls, as the domains have little history.

The campaign's final destination was a site using a zero in place of the "o" in "shop," promoting a browser extension styled after a legitimate shopping assistant. Visitors risked credential and payment theft, as well as exposure of browsing activity. The tracking parameters could also generate affiliate revenue for the operator. While the research did not report specific victims or losses, it highlighted the potential harms and advised blocking the identified domains and IP addresses.

Source: Infosecurity Magazine