“Evasive Dragon” and the Fake Store Syndicate: How DNS Intelligence Protects Brands from Online Threats

DomainTools：As the digital landscape evolves rapidly, online scams have become more complex and frequent. With brands expanding their presence on popular platforms like Pinterest, they’re also increasing their exposure to cyber threats. A recent investigation by DomainTools highlights how DNS and domain intelligence can play a critical role in identifying and mitigating these threats — in this case, a campaign of fake e-commerce sites likely orchestrated by a Chinese cybercriminal group.

Pinterest as a Growing Vector for Online Scams

The case study begins with the discovery of a malicious sponsored ad on Pinterest that led users to Llbeanfactoryoutlets.shop, a cloned version of the official L.L.Bean site. Clues like the unusual .shop TLD and JavaScript obfuscation hinted at its malicious nature. This domain was first registered on December 24, 2024 — a strategic date that aligns with low vigilance during the holidays.

Further investigation uncovered a network of similarly suspicious domains including:

• Llbean-usaaus.shop (Created on November 29, 2024)
• Ariatpromotions.shop (Created on December 24, 2024)
• Llbeancrazydealca.shop (Tied to registrants and infrastructure located in China)

All sites shared telltale signs: cloned designs, shared IP addresses (notably 104.18.73.116 on Cloudflare), and even Mandarin characters embedded in their source code. Together, these patterns suggest a coordinated effort by a single cybercrime actor or group.

Attribution: Who’s Behind the Fake Store Network?

DomainTools dubbed the group behind these operations “Evasive Dragon”, due to their ability to stay hidden and move quickly. While definitive attribution is challenging, there’s a high confidence assessment that the operators are Chinese, based on technical indicators, language use, and registrar behavior.

These operations share behavioral traits with known Chinese cybercrime organizations, such as the so-called “Fake Store Syndicates” that impersonate major Western retail brands and leverage bulk domain registrations using .shop, .top, .vip, .cn, and other TLDs. These groups are involved in credit card theft, identity fraud, and sometimes money laundering through fake storefronts.

Moreover, there’s a moderate confidence link to APT41 (Winnti Group), a state-backed Chinese threat group known for its dual role in cyber espionage and financial crime, though direct attribution remains inconclusive.

How DNS Intelligence Uncovers Hidden Threats

Using tools like DomainTools Iris Investigate and Farsight DNSDB, analysts can:

• Identify suspicious domains shortly after registration
• Track infrastructure changes (e.g., IP movements between Cloudflare and Google)
• Link seemingly unrelated domains through registrant data, language settings, and coding patterns

For example, the domains listed above were tied together not just by shared infrastructure, but by their use of Mandarin in their source code — further corroborating suspicions about the actor’s origin. Additionally, Reddit and other open-source intelligence (OSINT) sources helped surface more related domains that were likely part of the same campaign.

The Cross-Sector Risk: Not Just Retail

While the case began with a retail lens, its implications stretch across multiple industries. Financial institutions like Bank of America and technology companies such as HP and PayPal are already leveraging Pinterest for brand engagement. The same platforms can be hijacked by threat actors to impersonate these brands — making financial and tech sectors equally vulnerable.

Brand impersonation campaigns have the potential to harvest user credentials, infect devices with malware, or trick employees into downloading malicious files in the course of legitimate work.

Defending Against the Fake Store Syndicate

Brands can strengthen their defenses by:

• Monitoring newly registered domains with typosquats or brand mimicry
• Using DNS and domain intelligence tools for early detection
• Investigating shared infrastructure like IP addresses and registrars
• Collaborating with cybersecurity vendors to proactively identify spoofed sites

Tools like Iris Detect can provide email alerts for suspicious domains, enabling cybersecurity teams to act faster before harm is done.

Final Thoughts

The rise of fake online storefronts is more than just a retail nuisance — it’s a cross-industry cybersecurity threat. The campaign uncovered by DomainTools reveals a sophisticated, persistent adversary adapting its methods to exploit trends in online consumer behavior. Brands, especially global ones, must shift from reactive takedowns to proactive threat hunting.

DNS and domain intelligence are no longer optional — they are essential. They enable faster decision-making, help protect consumers from credential theft, and provide the visibility needed to fight back against actors like “Evasive Dragon.” As the battle for brand trust continues, those equipped with the right intelligence will be better prepared to defend their digital presence.

Read more at DomainTools