Massive Phishing Campaign Uses 6,000 Sites to Mimic Popular Brands

Bolster’s threat research team recently discovered an extensive brand impersonation effort targeting over 100 well-known clothes, footwear, and apparel firms.

The peak phishing activity for this campaign occurred between November 2022 and February 2023, after becoming active around June 2022.  

Nike, Puma, Asics, Vans, Adidas, Columbia, Superdry Converse, Casio, Timberland, Salomon, Crocs, Sketchers, The North Face, UGG, Guess, Caterpillar, New Balance, Fila, Doc Martens, Reebok, Tommy Hilfiger, and countless more well-known companies are among those impacted by this campaign.

A massive network of brand imitation scam websites with over 3,000 domains and around 6,000 sites, including inactive ones, was discovered via investigation.

In this case, email security solutions like Trustifi stops advanced email threats targeting Your business emails with AI-Powered email security.

Specifics of the Massive Phishing Campaign

The campaign domains linked to this fraud may be linked to the autonomous system with the number AS48950. 

Researchers said that the two specialized internet service providers, Packet Exchange Limited and Global Colocation Limited, host the IP addresses for these domains.

It’s important to remember that both suppliers have a terrible reputation for being vulnerable to scams.

The average domain age is between two and 90 days, and most are registered through Alibaba.com Singapore.

“In their attempts to deceive, the attackers predominantly utilize a pattern of combining the brand name with a random country name, followed by a generic top-level domain (TLD),” explains the Bolster’s threat research team.

Fraud potential

Examples of Puma-targeting domains include puma-shoes-singapore[.]com, pumaenmexico[.]com.mx, bestpumaindia[.]in, and much more.

Domain aging is an essential component in phishing operations. The longer a domain is active yet harmless, the less likely it is to be identified as suspicious by security systems.

Confiant noted last year that a domain should be allowed to age for at least two years after spotting the strategy being used successfully by a global malvertising operation since 2018.

Many of the malicious sites in the Bolster-found campaign persisted long enough without being detected that Google Search crawled them, and they now probably score highly for particular search phrases.

“Attackers are employing various search engine optimization (SEO) techniques to manipulate search engine rankings and increase visibility”, researchers.

Site for Clarks coming up top in Google Search

Customers who fail to recognize that these websites are not official brand sites frequently fall for the trap.

They willingly expose their personal information when they input their email, password, and payment card information.

 Even worse, some of these imitation websites are ranked highly in search engine results, which makes it simpler for victims to go upon them and believe them to be trustworthy unintentionally.

Recommendation

  • Users should confirm the legitimacy of websites, especially when dealing with well-known brands.
  • Watch out for any indications of a questionable domain name.
  • You should go above and above to confirm the site’s integrity if you encounter a deal or product pricing that looks too good.

Stop Advanced Email Threats That Target Your Business Email – Try AI-Powered Email Security

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Critical Vulnerability in Lovable’s Security Policies Allows Malicious Code Injection

Security researchers have uncovered a widespread vulnerability in Lovable's AI-powered development platform that exposes sensitive…

23 minutes ago

CISA Issues Alert on Erlang/OTP SSH Server RCE Vulnerability Under Active Exploitation

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical…

2 hours ago

Indian Authorities Bust Cybercriminals Posing as Microsoft Tech Support

India's Central Bureau of Investigation (CBI), the nation's federal law enforcement agency, launched a sweeping…

2 hours ago

Malicious Actors Exploit SoraAI’s Popularity & GitHub to Distribute Malware

Threat actors are leveraging the growing popularity of OpenAI’s Sora, a cutting-edge video generation model,…

3 hours ago

Malware Deployment Campaigns: ‘Librarian Ghouls’ APT Group Targets Organizations

The Advanced Persistent Threat (APT) group known as "Librarian Ghouls," also tracked as “Rare Werewolf”…

3 hours ago

SAP Security Patch Day: 14 Vulnerabilities Resolved Across Various Products

SAP's June 10, 2025 Security Patch Day delivered critical security updates addressing 14 distinct vulnerabilities…

3 hours ago