Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A network of 71 purchase scam websites has been identified, linked to 12 shared merchant accounts used for fraudulent transactions. The scams employ brand impersonation, online ads, and malicious merchants to target victims. The network, operational since February 2025, uses typosquatting and brand logo abuse to impersonate legitimate retailers. Transactions with the identified merchant accounts are likely fraudulent and facilitate card compromise. The network's attribution remains unclear, possibly controlled by a single actor or multiple actors collaborating through dark web services. Mitigation strategies for card issuers and merchant acquirers are provided to reduce financial fraud and compliance risks associated with these scams.

This threat involves a coordinated network of 71 fraudulent purchase scam websites that have been active since February 2025. These sites leverage brand impersonation techniques, including typosquatting—registering domain names similar to legitimate retailers—and misuse of brand logos to deceive victims into believing they are interacting with trusted merchants. The scam network is supported by 12 shared merchant accounts that process transactions, which are likely fraudulent and facilitate card compromise and transaction laundering. Victims are targeted through online advertisements that direct them to these malicious sites, where they may unknowingly submit payment information. The network’s operational structure is unclear; it may be controlled by a single threat actor or multiple actors collaborating via dark web services. The campaign employs various tactics and techniques aligned with MITRE ATT&CK identifiers such as T1587.001 (Develop Capabilities), T1586.001 (Compromise Accounts), T1598.003 (Phishing for Information), and others related to command and control, execution, and credential access. Although no direct exploits or malware are involved, the threat exploits social engineering and fraudulent transaction mechanisms to achieve financial fraud. The compromised merchant accounts facilitate laundering of illicit transactions, increasing the risk for card issuers and merchant acquirers. This scam network poses a significant risk to consumers and financial institutions by enabling unauthorized card use and financial loss. Mitigation strategies focus on enhanced transaction monitoring, merchant account vetting, and consumer awareness to reduce fraud and compliance risks.

Detailed information about Brand impersonation, online ads, and malicious merchants help purchase scam network prey on victims. Get real-time updates, technical

Brand impersonation, online ads, and malicious merchants help purchase scam network prey on victims - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'dark web services'

Filter Threats

Threats Tagged 'dark web services'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility