71 Fake Sites Masquerading as German Retailer to Steal Payment Data

A sophisticated payment fraud campaign has been uncovered, targeting consumers and the financial ecosystem through an elaborate network of 71 fake online stores, many of which impersonate a prominent German international discount retailer.

This campaign, revealed by Recorded Future Payment Fraud Intelligence on May 8, 2025, centers on the domain lidlorg[.]com and involves a sprawling infrastructure of fraudulent merchant accounts and coordinated brand abuse.

The core objective of this operation is the theft of payment card data and the facilitation of downstream fraud, representing a significant and evolving risk to cardholders, financial institutions, and payment processors.

Industrial-Scale Brand Impersonation

The operation employs brand impersonation on a scale rarely seen, leveraging typosquatted domains and unauthorized use of brand logos to lure unsuspecting shoppers.

The scam network does not simply mirror phishing tactics; instead, it distinguishes itself by integrating multiple fraudulent merchant accounts, enabling direct processing of victim payments.

Unlike traditional phishing sites that collect card details via fake forms, these sites execute actual transactions, almost guaranteeing card compromise.

Lidlorg[.]com serves as the bellwether of the network, using coordinated ad campaigns via compromised advertiser accounts or dark web malvertising services to generate targeted traffic.

Recorded Future identified 71 interrelated scam domains, many less than three months old, with an average DomainTools risk score of 88/100 a near-certain indicator of malicious activity.

These domains collectively employ twelve merchant accounts, including entities such as AKRU KERAMIK GMBH, CLOTHWEARABLY, MYCOZYBABIES, and YSP*QHWLKJSHOP, operating across various merchant category codes (MCCs) and acquirer bank identification numbers (BINs).

A notable technical sophistication is visible in the way these merchant accounts are used for transaction laundering.

Fraudsters often associate merchant accounts with seemingly unrelated URLs, obfuscating the true destination of payments and concealing fraudulent activity from acquiring banks.

For instance, a merchant account registered to “PETHOUSEN LLC” is tied to domains unrelated to its apparent business, a classic hallmark of transaction laundering.

Dark Web Fraud Ecosystem

Attribution of this scam infrastructure remains unresolved. The evidence indicates either a single threat actor orchestrating the entire merchant and domain apparatus or, more plausibly, multiple criminal groups leveraging shared “cash-out” and fraud services on the dark web.

Merchant registration data, such as recurring company information or registration patterns, may hold the key to future attribution.

However, the observed overlap among merchant accounts and the diversity of scam domain deployment suggest a dynamic marketplace of illicit infrastructure rental, with threat actors potentially rotating merchant and domain assets to evade detection.

This dark web-fueled ecosystem also powers related services: malvertising to drive fraudulent traffic, traffic services to amplify scam ad reach, and merchant account rentals to monetize stolen card data through ostensibly legitimate transactions.

The speed at which domains are spun up and cycled through merchant accounts underscores this professionalization and liquidity in cybercrime infrastructure. For the payments industry, these purchase scams are doubly hazardous.

They not only inflict direct losses on cardholders but also create regulatory exposure for merchant acquirers, especially where transaction laundering intersects with known scam merchant activity. Recorded Future recommends a multi-layered mitigation approach.

Card issuers should track and immediately decline transactions with the identified scam merchant accounts, elevate fraud risk scores for customer accounts with attempted or successful transactions, and, where threshold events are identified, consider proactive card reissuance.

Payment acquirers, meanwhile, are urged to leverage acquirer BIN/MCC analysis and domain-based merchant data correlation to identify and suppress fraudulent merchant accounts in their portfolios.

Enhanced due diligence, rapid investigation, and, where necessary, suspension or termination of suspect merchant accounts are vital to disrupt the ongoing scam network.

The outlook remains troubling: the scam network has expanded continuously since at least February 2025, with operators likely to spin up new domains and merchant accounts as older infrastructure is burned.

Termination of the fraudulent merchant accounts alone may slow but not halt the underlying operation, which thrives on cheaply replaceable digital infrastructure and decentralized dark web support.

Indicators of Compromise (IOCs)

Scam Domain	Merchant Name	Date Seen
lidlorg[.]com	YSP*NIHILSTOOL, REFINEDHAT, LMS AESTHETICS	2025-04-19/23
outletmalleu[.]shop	PETHOUSEN LLC, LMS AESTHETICS, AKRU KERAMIK GMBH	2025-04-30
bililability[.]com	MYCOZYBABIES, PETHOUSEN LLC	2025-04-19
boxrawstore[.]shop	REFINEDHAT	2025-04-19
discountmarkets[.]shop	CLOTHWEARABLY	2025-03-07
ecofoodcontainers[.]shop	ONCLOTHESSHOES	2025-04-30
finalclearancehub[.]com	MYCOZYBABIES, ONCLOTHESSHOES	2025-04-26
goldberghdeals[.]shop	REFINEDHAT	2025-04-14
lidlmarket[.]store	YSPQHWLKJSHOP, YSPNIHILSTOOL	2025-04-03
snowpeakk[.]shop	YSP*QHWLKJSHOP	2025-04-26
vejadeals[.]shop	ONCLOTHESSHOES	2025-04-23
wayfairbestoffers[.]com	YSP*QHWLKJSHOP	2025-03-26
…	…	…

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates