Govt abstract

Malicious actors all the time attempt to be inventive and discover new methods to trick folks right into a rip-off. On this case a brand new web site is providing 75% low cost on all Timberland footwear. The data seems nearly an identical to the unique web page, however when trying nearer questions begin to pop.

Key takeaways:

• Faux web sites and phishing makes an attempt are likely to rise earlier than holidays.
•  Santa’s 75% low cost within the case beneath will most likely result in lack of cash or folks being upset by shopping for faux footwear

Evaluation

Yesterday I acquired a message in one in every of my WhatsApp teams:

“75% low cost on Timberland model for 72 hours, Get pleasure from!” and a hyperlink to the web site kopwor[.]com

To be sincere, for a second trying on that web site, I assumed how fortunate I’m with Santa’s presents this yr with 75% low cost on all Timberland footwear! Within the first look on the web site it appeared promising and legit, all kinds of footwear and detailed info on all.

Determine 1. 75% low cost on all footwear

Then I began to assume, properly let’s test this web site, first – I by no means heard about it, and second – it is too good to be true.

So let’s see what info we are able to extract from the web site. Very first thing we are able to test when it was registered utilizing a whois on-line service corresponding to who.is or domaintools.com.  Whois question tells us that the web site was registered solely 5 months in the past on 2021-07-07 on “NameSilo”. As well as, web site historical past utilizing the wayback machine – an archive of web web sites – we see that on 2021-12-10 the web site had no content material.

The web site is hosted on Cloudflare and utilizing the host certificates service for SSL:

Determine 2. Web site certificates

Trying on the web page supply we are able to discover some feedback in Chinese language:

Determine 3. Chinese language touch upon web page supply

Clicking on any of the hyperlinks within the backside of the web page together with “About Us” and “Delivery & Deliveries” returns “Web page not discovered”:

Determine 4. Lacking net pages such “About Us”

If we go to buy, there isn’t any enter validation:

Determine 5. No enter validation

And final, let’s examine one shoe from the suspicious web site with Timberland’s unique web site.

Let’s look nearer at: “Males’s Timberland Premium 6-Inch Waterproof Boots” on kopwor web site VS “Males’s Timberland® Premium 6-Inch Waterproof Boots” on Timberland web site. (discover the lacking “R” image after Timberland identify in shoe description in kopwor web site)

Determine 6. Comparability between comparable footwear on each web sites

Unique value US$ 198 on each, discounted value on kopwor: US$ 49.50.

in a fast look, we are able to see the similarities between the footwear – colour is a bit completely different however total their construction seems comparable.

When trying extra carefully we are able to discover extra vital modifications, so let’s play “discover the variations”:

Determine 7. Nearer have a look at each footwear

Some variations on the picture marked in colours:

•  Colour of the stitches
•  R mark signal measurement and site
•  Couple of variations on the emblem
•  The colour of the only real

As well as, there are some good web sites corresponding to scamadvisor that may assist us with deciding on suspicious web sites.

In our case it tells us the unfavourable highlights of kopwor web site:

• The registrar has a excessive % of spammers and fraud websites
• The proprietor of the web site is utilizing a service to cover their id on WHOIS
• This web site is (very) younger.
•  Excessive variety of suspicious web sites on this server

Backside line, both it is a phishing web site aimed to steal consumer cash, or it is a web site promoting faux Timberland footwear. Both approach it is best to all the time search for suspicious indicators when unknown web sites supply wonderful offers.

At the moment the 72 hour sale is over, however discounted costs are nonetheless the identical – one other purple flag.

Secure browsing and Blissful holidays!

Really helpful actions

1. Watch out when shopping for from untrustworthy web sites.
2. Attempt to concentrate for essential info, corresponding to web site certificates