Network Abuses Leveraging High-Profile Events: Suspicious Domain Registrations and Other Scams
Unit 42 found scammers surge deceptive domain registrations around major events like the 2024 Paris Olympics to run phishing and counterfeit merchandise scams.
Unit 42 analyzed newly registered domains (over 200,000 detected daily from zone files, WHOIS, and passive DNS) containing event-specific keywords, using the 2024 Paris Summer Olympics as a case study. Threat actors register lookalike domains to sell counterfeit merchandise, push fraudulent services, and run phishing, as previously seen with COVID-19-themed and fake ChatGPT tool scams. The article recommends monitoring domain registrations, DNS and URL traffic trends, textual patterns, and verdict change requests to catch event-themed abuse early.
- Event-themed domain registrations spike around events like the Paris Olympics
- Over 200,000 newly registered domains are detected daily for analysis
- Deceptive domains often combine event keywords with terms like 'rewards'
- DNS/URL traffic spikes and verdict change requests signal active abuse
- Past waves include COVID-19 phishing and fake ChatGPT tool scams
- ATT&CK
- T1583.001 Acquire Infrastructure: DomainsT1566.002 Spearphishing LinkT1204.002 Malicious FileT1656 Impersonation
- Vendors
- Palo Alto Networks
- Organizations
- Unit 42Palo Alto Networks
- Countries
- France
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 2021olympicupdateslive.com | ddress 3.64.163[.]50 was shared by domains from 2021 (e.g., 2021olympicupdateslive[.]com ) and those from 2024 (e.g., parisolympicgames2024[.]com |
| domain | 2024olympicslive.com | .g., tokyoolympicsport[.]com ) and the 2024 Olympics (e.g., 2024olympicslive[.]com ). From the observed infrastructure patterns, we infer th |
| domain | 2024olympics-shop.com | nt. Figure 8 shows two screenshots from the landing page of 2024olympics-shop[.]com that tricked visitors into registering for a bogus invest |
| domain | 2024parisolympicathletes.com | Persistent Olympic Targeting Threat 2024olympicslive[.]com 2024parisolympicathletes[.]com olympicparis2024[.]com paris-olympics2024[.]com paris24ol |
| domain | allolympic.com | climbolympic[.]com . Figure 10. Gambling website hosted on allolympic[.]com . Figure 11. Gambling website hosted on olympiarealestate |
| domain | climbolympic.com | within this campaign. Figure 9. Gambling website hosted on climbolympic[.]com . Figure 10. Gambling website hosted on allolympic[.]com |
| domain | olympiarealestate-online.com | on allolympic[.]com . Figure 11. Gambling website hosted on olympiarealestate-online[.]com . Indicators of Compromise Suspicious Domains From Persis |
| domain | olympicparis2024.com | hreat 2024olympicslive[.]com 2024parisolympicathletes[.]com olympicparis2024[.]com paris-olympics2024[.]com paris24olympics[.]com parisolymp |
| domain | olympics.apk | e site also offers a download link for an Android app named Olympics[.]apk that poses as a legitimate cash app, but it is actually s |
| domain | paris24olympics.com | letes[.]com olympicparis2024[.]com paris-olympics2024[.]com paris24olympics[.]com parisolympic24[.]com parisolympicgames2024[.]com parisoly |
| domain | parisolympic24.com | is2024[.]com paris-olympics2024[.]com paris24olympics[.]com parisolympic24[.]com parisolympicgames2024[.]com parisolympicgames2024official |
| domain | parisolympicgames2024.com | , 2021olympicupdateslive[.]com ) and those from 2024 (e.g., parisolympicgames2024[.]com ). In addition, multiple domains from both Olympic events |
| domain | parisolympicgames2024official.com | pics[.]com parisolympic24[.]com parisolympicgames2024[.]com parisolympicgames2024official[.]com parisolympicgamesevents[.]com parisolympicgamesofficial[. |
| domain | parisolympicgamesevents.com | solympicgames2024[.]com parisolympicgames2024official[.]com parisolympicgamesevents[.]com parisolympicgamesofficial[.]com parisolympicgamestickets[ |
| domain | parisolympicgamesofficial.com | lympicgames2024official[.]com parisolympicgamesevents[.]com parisolympicgamesofficial[.]com parisolympicgamestickets[.]com parisolympicsphotographe[. |
| domain | parisolympicgamestickets.com | risolympicgamesevents[.]com parisolympicgamesofficial[.]com parisolympicgamestickets[.]com parisolympicsphotographe[.]com parisolympictickets[.]com |
| domain | paris-olympics2024.com | .]com 2024parisolympicathletes[.]com olympicparis2024[.]com paris-olympics2024[.]com paris24olympics[.]com parisolympic24[.]com parisolympicga |
| domain | parisolympicsphotographe.com | isolympicgamesofficial[.]com parisolympicgamestickets[.]com parisolympicsphotographe[.]com parisolympictickets[.]com Scam Domains Leveraging Olympic |
| domain | parisolympictickets.com | risolympicgamestickets[.]com parisolympicsphotographe[.]com parisolympictickets[.]com Scam Domains Leveraging Olympics 2024olympics-shop[.]com |
| domain | tokyoolympicsport.com | . This included domains targeting previous Olympics (e.g., tokyoolympicsport[.]com ) and the 2024 Olympics (e.g., 2024olympicslive[.]com ). |
| ipv4 | 3.64.163.50 | ympics and the Paris Olympics. For instance, the IP address 3.64.163[.]50 was shared by domains from 2021 (e.g., 2021olympicupdates |
| ipv4 | 76.223.67.189 | tion, multiple domains from both Olympic events resolved to 76.223.67[.]189 . This included domains targeting previous Olympics (e.g. |
From the original article
10 min read at unit42.paloaltonetworks.com
Threat actors frequently exploit trending events like global sporting championships to launch attacks, including phishing and scams. Because of this, proactive monitoring of event-related domain abuse is crucial for cybersecurity teams. Our network abuse investigations regularly uncover suspicious domain registration campaigns, particularly those using event-specific keywords or phrases in newly registered domains.
unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.