Allurity company Security Research Labs (SRLabs) has conducted an investigation into a sprawling criminal e-commerce network that operates fake webshops. These fake shops have processed over a million orders with an aggregate order volume of USD 50 million over the past three years.

Key Takeaways

– A criminal network operates tens of thousands of fake webshops, frequently leveraging previously expired domains with good Google reputation

– Victims access “BogusBazaar” shops hoping for deals on shoes and apparel, but get their credit card details stolen instead.

– Over 850,000 customers have already fallen victim, mostly from Western Europe and the USA; and almost none from China, the main operating hub of the fraudsters.

–  When ordering online, a deal that sounds too good, probably is. Services like Fakeshop Finder [German] help consumers check if webshops are legitimate.

Fraud Impact

The criminal group, which SRLabs named BogusBazaar, operates an extensive network of 75,000+ domains hosting fraudulent webshops. As of April 2024, approximately 22,500 domains were active. The network has processed more than one million orders since 2021, with an estimated aggregate order volume exceeding USD 50 million.

Not every order results in successful payment, so the actual primary financial damage is lower. Secondary damages caused by fraudulent use of stolen credit card details add to the overall damage.

The SRLabs research is covered by Die Zeit (German), The Guardian (English), and Le Monde (French). A subset of this criminal network has previously been reported on by Yarix.

The criminal network has grown for years through low-key highly-scalable fraud. SRLabs insights enable network infrastructure operators, payment providers, and search engines to identify the crime nucleus and prevent future large-scale abuse.

SRLabs shared research findings with relevant stakeholders including authorities. Some of the fake shops are now offline.

Please send questions about this research to: bogusbazaar@srlabs.de