Researchers Identify AliExpress Phishing Domains Before Registration

EfficientIP flagged ten .cyou domains before registration that later led to an AliExpress phishing site.

EfficientIP Research Labs said it identified 10 .cyou domains on June 9 that were registered and began resolving on July 2. The names, each one digit and five lowercase letters, shared a registration date, resolved to three addresses in one subnet, and redirected through tracking parameters. The destination was a fake AliExpress site, using a zero instead of the o in shop, that promoted an Alitools-style browser extension. The research reports no victims or losses and does not explain how visitors were directed there; ANY.RUN had tagged the destination as phishing on May 22.