{"id":10436,"date":"2024-07-29T08:00:59","date_gmt":"2024-07-29T15:00:59","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=10436"},"modified":"2024-07-29T04:50:29","modified_gmt":"2024-07-29T11:50:29","slug":"olympics-scammers-take-their-marks-get-set-and-go","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/olympics-scammers-take-their-marks-get-set-and-go\/","title":{"rendered":"Olympics Scammers Take Their Marks, Get Set, and Go!"},"content":{"rendered":"

Authors: Kat Persighetti<\/strong><\/h3>\n

 <\/p>\n

Every iteration of the Olympic games is a major global event \u2013 fueling pride and competition, watched by millions in homes around the world, and by thousands who travel to watch events in person. Such large audiences and levels of international interest have consequently drawn the attention of cybercriminals, some of whom have been preparing since before the Olympic national teams were even finalized. In this blog we will share some of the trends we have been seeing leading up to and following the opening of the Paris Olympics. <\/p>\n

Sprinting Towards Fast Cash<\/h3>\n

Among the myriad phishing and spear phishing lures related to the games, ticket sale scams have been the most popular and common theme. Fraudulent ticket sale websites, mobile recharge plan offers, and merchandise seller scams have been widespread leading up to the 26 July opening ceremonies, but there have also been customized email campaigns to spear phish targeted audiences. A world of nefarious options for a global pool of victims. Moreover, according to a recent article from Fortinet, today\u2019s phishing kits allow even the more inexperienced threat actors to get in on the action with a simple user interface to build out their campaigns.i<\/sup><\/p>\n

There have been hundreds of domains registered that allege to offer discounted tickets to the Paris Olympics. The landing pages to these websites are sophisticated, often user friendly, and appear so legitimate that almost anyone would have difficulty picking out the real page (tickets[.]paris2024[.]org<\/span>), from the lookalikes, such as ticketsparis24[.]com<\/span>. As shown by the images in Figure 1 below, even the landing page for this lookalike appears to lack many of the red flags often associated with fake sites, such as spelling errors, bad grammar and minimal content. Could you tell the difference? <\/p>\n\n\n\n\n
\n\"\"\n <\/td>\n\n\"\"\n <\/td>\n<\/tr>\n
Figure 1. Left: Landing page for legitimate website tickets[.]paris2024[.]org for purchasing event tickets. Right: Landing page for fraudulent website ticketsparis24[.]com<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Identifying phishing pages like the one above is even more difficult when people are accustomed to being able to purchase tickets from legitimate sites that buy tickets in bulk and then resell them, such as StubHub and TicketMaster. If sports fans are not aware that the only legal way to sell or resell tickets to the Paris Olympics is to go through the site tickets[.]paris2024[.]org<\/span> and use their platform, they are more likely to fall victim to well-designed fake sites. <\/p>\n

Threat actors are also spoofing merchandise websites and claiming to offer mobile data recharge plans. 2024olympics[.]shop<\/span> and shop-olympics[.]shop<\/span> are two domains claiming to sell merchandise, but in reality they steal the victims\u2019 funds and information without ever sending any products. Like the ticket scam websites, the example in Figure 2 shows that the landing pages are well designed and do not show the characteristic red flags that often tip off casual users that they are phishing sites. <\/p>\n\n\n\n\n
\n\"\"\n <\/td>\n<\/tr>\n
Figure 2. Landing page for 2024olympics[.]shop<\/span> <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Similarly, there is a group of over sixty registered domain generated algorithm (RDGA)<\/a> domains that share the website title \u201cTo Celebrating 2024 Paris Olympics Whatsapp offers 48GB free Mobile Recharge Plans!\u201d. Figure 3 shows the website, which offers free data plans for the Olympic games. Many of these RDGA domains were registered a year ago with the intention to gather victims\u2019 personal information in exchange for accessing the \u201cfree\u201d service. <\/p>\n\n\n\n\n
\n\"\"\n <\/td>\n<\/tr>\n
Figure 3. Landing page for the group of RDGA domains promoting data package scams <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Going the Distance with Lookalikes<\/h3>\n

In 2023, Infoblox Threat Intel reported on the threat landscape of lookalike domains<\/a>. These kinds of sites impact everyone \u2013 they pose challenges for security teams and are ever-present risks to individuals simply browsing the internet or scrolling through their email. It\u2019s easy to see why nefarious actors favor them in their campaigns.<\/p>\n

As an opportunity for cybercriminals, not only are the Olympic games globally popular and therefore offer a huge pool of potential victims, but they are recurring and predictable so the actors can prepare for them long in advance. Our lookalike detection algorithms picked up indicators that were created as early as September 2023 to spoof this summer\u2019s games. Several examples include parissummerolympics2024[.]online<\/span>, olympics2024[.]cc<\/span> and olympicsparis[.]shop<\/span>. <\/p>\n

Just as Olympic athletes train for years to go for gold, we\u2019re starting to see signs that threat actors are preparing for future opportunities. Based on the patterns we have seen from previous Olympic years, here are some examples of registered lookalike domains that we consider suspicious: <\/p>\n