Researchers Trace Phishing Domains Before Aliexpress Campaign Arabian Post

(MENAFN- The Arabian Post) clearfix">Security researchers say they identified 10 suspicious domain names weeks before they were registered, then watched the addresses become active as disposable gateways to an AliExpress-themed phishing operation.

EfficientIP Research Labs said the. cyou domains were identified on June 9 and added to its DNS Threat Pulse intelligence feed. The addresses were registered and began resolving to internet protocol addresses on July 2, allowing investigators to connect their shared infrastructure and redirects to a fraudulent shopping site impersonating the AliExpress ecosystem.

The finding is notable because conventional reputation-based defences often assess domains only after they have accumulated registration, hosting or traffic history. Newly created addresses can therefore present a detection gap when first activated. EfficientIP said DNS patterns can provide earlier indicators that allow defenders to investigate infrastructure before established reputation systems classify it.

All 10 addresses used the same naming structure: a single digit followed by five lowercase letters. They were registered on the same date and resolved to three IP addresses - 46.8.9.220, 46.8.9.222 and 46.8.9.223 - within the same subnet, according to the company's technical analysis.

Researchers described the names as“DGA-style” because their random-looking construction resembles domains produced by domain generation algorithms, which can be used to create large pools of disposable addresses. EfficientIP cautioned, however, that the naming pattern alone does not establish that a DGA generated the domains.

The addresses did not directly host the phishing page. Instead, they acted as entry points, forwarding visitors through tracking infrastructure containing campaign, click or affiliate parameters. That design could allow an operator to replace domains that have been blocked or exposed while retaining the rest of the redirect and tracking system.

See also Gambling Goblin repurposes Brazil government sites for SEO

Investigators traced the chain to alish0p. com, a lookalike address using the numeral zero in place of the letter“o”. The destination presented itself as a shopping service associated with AliExpress and promoted a browser extension styled after Alitools, a legitimate shopping-assistant brand. The page claimed more than 500,000 users and prompted visitors to add the extension to their browser.

Independent security services had already classified the destination as suspicious or malicious. ANY. RUN's malware-analysis sandbox tagged the destination as phishing on May 22, before the 10 redirect domains became active. That chronology means EfficientIP's pre-registration finding concerned the later entry-point domains, rather than advance discovery of the final phishing destination itself.

EfficientIP said interaction with the campaign could expose users to credential or payment-data theft and potentially reveal browsing activity through an untrusted extension. Tracking parameters in the redirect chain could also provide affiliate revenue to the operator. The researchers did not report confirmed victims, financial losses or evidence establishing precisely what the promoted extension did after installation.

The research also did not establish how users were initially directed to the 10 domains, leaving the campaign's distribution mechanism unclear. Nor did the published technical account explain in detail how the researchers identified the exact domain names before their registration, although the company said the addresses had been detected and entered into its threat-intelligence system on June 9.

The choice of the. cyou top-level domain provided an additional risk signal but was not treated as proof of malicious activity. Cloudflare's analysis of unwanted email found that 62 per cent of email observed from. cyou domains in 2023 was classified as malicious. Researchers stressed that a domain suffix by itself cannot determine whether an individual site is harmful.

See also PeckBirdy traffic reaches enterprise networks through casino decoys

A 2025 phishing landscape study by Interisle Consulting Group found that 77 per cent of domains used for phishing had been registered specifically for malicious purposes, while 37 per cent were acquired through bulk-registration services. Such registrations can help operators rapidly rotate infrastructure as individual addresses are detected and blocked.

MENAFN26092026000152002308ID1111720028