Full Report
Access expert insights on how brand impersonation, online ads, and malicious merchants help a purchase scam network prey on victims
Analysis Summary
# Tool/Technique: Purchase Scam Websites (Network including lidlorg[.]com)
## Overview
This is a network of **purchase scam websites** that rely on **brand impersonation** (typosquatting and logo abuse) to defraud victims, primarily targeting customers of a German international discount retailer via the domain `lidlorg[.]com`. Unlike simple phishing sites, these scams process visitor transactions using shared merchant accounts, facilitating financial fraud and potential card compromise.
## Technical Details
- Type: Attack Infrastructure (Scam Websites/Financial Fraud Operation)
- Platform: E-commerce/Web Platforms (Targeting global consumers)
- Capabilities: Brand impersonation, transaction processing, data theft.
- First Seen: `lidlorg[.]com` identified on April 19, 2025. The overall network operates since at least February 2025.
## MITRE ATT&CK Mapping
This operation primarily focuses on financial fraud and deception rather than traditional persistence or execution on endpoint devices. Mappings are related to initial access tactics involving deception.
- **TA0001 - Initial Access**
- **T1566 - Phishing**
- T1566.002 - Spearphishing Link (Relevant if ads lead directly to the scam site)
- **TA0003 - Persistence** (Implicit in maintaining the network)
- **T1598 - Technique Unknown** (Related to using advertised campaigns for propagation, e.g., illegitimate ads)
## Functionality
### Core Capabilities
- **Brand Impersonation/Typosquatting:** Abusing brand names and logos (e.g., targeting a German retailer via `lidlorg[.]com`).
- **Transaction Processing:** Utilizing linked merchant accounts (12 shared accounts identified) to process victim payments, differentiating them from pure data-harvesting phishing sites.
- **Data Theft:** Stealing victim personal and financial data during fraudulent transactions for downstream fraud.
- **Network Coordination:** Operating as a coordinated network of 71 scam domains utilizing overlapping merchant accounts.
### Advanced Features
- **Shared Infrastructure Abuse:** Leveraging the same 12 merchant accounts across numerous domains to monetize fraud efficiently.
- **Ad Propagation:** Utilizing online ad campaigns (e.g., on Facebook Ads) for initial dissemination, though many ads were later removed for "Unacceptable Business Practices."
## Indicators of Compromise
- File Hashes: [Not provided in context]
- File Names: [Not provided in context]
- Registry Keys: [Not applicable]
- Network Indicators:
- Primary Example Domain: `lidlorg[.]com`
- Other associated domains: `lidlmarket[.]store`, `lidlods[.]com`, `outletmalleu[.]shop`, etc. (See context for the full list)
- Merchant Accounts (Examples): `AKRU KERAMIK GMBH`, `ANT _ONLINE E-COMMERCE STO`, `BALSAMIC`, `CLOTHWEARABLY`, `LMS AESTHETICS`, `MYCOZYBABIES`, `ONCLOTHESSHOES`, `PETHOUSEN LLC`, `REFINEDHAT`, `YSP_ CLOTHINGGSHOP`, `YSP _NIHILSTOOL`, `YSP_ QHWLKJSHOP`.
- Behavioral Indicators:
- Use of typosquatting domains.
- Presence of active or historical online ad campaigns driving traffic to the sites.
- Website activity resulting in reported policy violations (e.g., "Unacceptable Business Practices" by ad platforms).
## Associated Threat Actors
- Attribution is unclear; the network structure suggests either a single highly organized entity or multiple threat actors collaborating (e.g., via dark web marketplaces offering scamming services).
- Entities responsible for registering and managing the shared merchant accounts are key to identifying the operators.
## Detection Methods
- Signature-based detection: Based on known bad domains and specifically associated merchant Account IDs.
- Behavioral detection: Monitoring for new domains exhibiting high-risk scores (average 88/100 in the sample) that register with payment processors known to be involved in this network.
- YARA rules: [Not provided in context]
## Mitigation Strategies
**For Card Issuers:**
- Take action against identified merchant accounts.
- Take action against card accounts that have transacted with these identified merchants.
**For Merchant Acquirers:**
- Take action against the identified merchant accounts linked to the scam network.
**General:**
- Monitoring for brand impersonation (typosquatting) targeting organizational brands.
- Reviewing payment processor risk profiles, especially for newly onboarded or previously low-risk accounts suddenly processing high volumes of suspicious transactions.
## Related Tools/Techniques
- Brand Impersonation (General technique)
- Typosquatting (Specific domain registration technique)
- Online Ad Campaigns (Propagation method)
- Purchase Scam Websites (Financial Fraud categorization)