Largest Network of Fake Card Shops Discovered – Phishing Sites Mimicking Legitimate Card Retailers

What happened

Group‑IB identified a sprawling network of phishing sites that present themselves as card‑shop retailers. The sites use convincing branding, fake product pages, and secure‑looking checkout flows to trick users into entering payment information. The operation appears to be coordinated and spans multiple TLDs.

Impact

Customers of legitimate card‑shop brands are at risk of having their card numbers, CVV, and billing addresses stolen. The stolen data can fuel card‑present fraud, identity theft, and further phishing campaigns. Merchants may suffer brand damage and regulatory penalties.

What to do

Defenders should take the following actions:

• Block the identified domains and IP ranges in firewalls and DNS filtering solutions.
• Update threat‑intelligence feeds to include the new phishing URLs.
• Enable multi‑factor authentication for all e‑commerce platforms.
• Run user‑education campaigns highlighting the look‑and‑feel of spoofed card‑shop sites.
• Monitor transaction logs for anomalous card‑present activity and flag suspicious orders for manual review.
• Coordinate with payment processors to detect and halt fraudulent transactions originating from the identified sites.

Mitigation

Deploy web‑filtering and sandboxing tools that can detect phishing content. Use TLS inspection to verify that legitimate merchants use valid certificates. Consider implementing a “card‑shop” whitelist that only allows transactions through verified merchant domains.

“The scale of this operation underscores the need for continuous threat‑intel sharing and proactive domain blocking.”