Rewterz Threat Alert – Phishers Create Fake Sites as Bait for Holiday Shopping Deals

Severity

Medium

Analysis Summary

While most users are familiar with phishing scams that attempt to steal a user’s login credentials, phishers also use emails to lure consumers to fake retail sites in order to steal their money or sell cheap knockoffs.

There’s been a significant increase in  phishing scams promoting e-commerce related phishing sites. And this year we can already see a similar trend. With only half of November over and even before the peak of Black Friday and Cyber Monday, use of e-commerce phishing URLs has more than doubled since last November’s peak – in fact, it’s up by 233%, researchers stated. 

This lookalike site was hosted on a domain named xwrbs[.]com, which was created on November 6th, 2019. Just one day later, Check Point observed it being used in phishing emails sent to thousands of users.

These phishing emails pretended to be a Black Friday promotion where consumers can purchase custom Ray-Ban sunglasses at 80% off the normal price.

Impact

• Financial loss
• Exposure of sensitive information

Indicators of Compromise

Domain Name

www.xwrbs[.]com

URL

• http[:]//www[.]xwrbs[.]com/un.html
• http[:]//www.xwrbs[.]com/

Remediation

• Block the threat indicators at their respective controls.
• Always be aware of the lookalike domains that look similar to the brand’s normal name.
• Look out for spelling errors or mistakes in the brand’s name.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.