Let me tell you a quick story. I love Johnston and Murphy shoes. I have been Been trying to get this pair for weeks., but since a lot of other people seem to like it too, it ended up being my very normal shoe size. So I did a Google search to see if I could find other stores that had it in stock.

And wouldn't you know it, there was another Johnston & Murphy site, with “USA” added to the URL. It looks like another site, but it had every single size of this shoe in stock, ready to buy. And it was half the original price, what a bargain! This must be an overstock outlet for the brand. So I put the shoe in my cart, and got ready to check out.

But for some reason, PayPal was the only payment option. No big deal, I use PayPal often and it has a purchase security program. So I went through the PayPal interface… and the last step in the process, which would confirm the order, said “Agree and Subscribe” instead of “Buy”. He also asked me to pay someone who is not Johnston & Murphy but “Association Islamic Philado”. No useful Google results for that name — the address is somewhere in Luxembourg, assuming it's the same person or organization.

Michael Crider/The Foundry

Michael Crider/The Foundry

Michael Crider/The Foundry

I've seen that button before. This is used when you want to make recurring payments to a charity or creator, a la Patreon. Why would I need to “subscribe” to the one-time payment option?

To be honest my red flags went up from the start when I saw the URL, but at that point I went in Arkham Asylum Detective Mode The first step was to check the phish URL with a Whois lookup. Central Johnston and Murphy Domain Registered for almost thirty years., and although it goes through a private registrar, that registrar is based in Florida in the US. If a judge in the US issues a subpoena to Johnston & Murphy, they will have someone to track down.

I tried to find the same with the “USA” alternative site, who had the shoe in stock and was willing to sell it to me via paypal subscription. It was registered to a Chinese company in January this year, with a Gmail address for a private registrar.

Now, since I'm posting this story publicly, I'm not going to accuse this site of being a scam. But I can't think of any legitimate reason why a Johnston & Murphy domain for an American company would be using a registrar in China. And I can't imagine why the PayPal system would let me “subscribe” to just pay for it, especially when the verified site only lets you pay by credit card. I decided to wait for these shoes.

I will say that fake retail storefronts are incredibly common, even showing up a lot in Google searches like I did. I've seen a lot of similar — and similarly dubious — sites in Google Shopping results that sell deeply discounted kayaks. They were similarly new stores, with designs that stole the layout of other stores, and with prices and availability that seemed too good to be true.

Oh A recent report by German firm Security Research Labs (Viewed by Bleeping computer) found a ring of fake retail sites running tens of thousands of domains. The “Bogus Bazaar” ring garnered 850,000 orders, most from the United States and Germany, with the rest of the “sales” going to Canada and Western Europe. Shops are quickly set up and copied with automated WordPress tools, including e-commerce plugins to accept information from PayPal, Stripe and other methods.

What is the purpose? They don't just receive the money and try to get away with it — which is harder than it sounds, now that banks, credit card companies, and other payment processors are on high alert for fraud. Instead they are collecting personal information, especially addresses and credit card numbers. Put all this information together, and it's a valuable starting point for an identity theft attempt.

SRLabs says BogusBazaar operates with a small team of system developers, who then sell their services to other fraudsters in a “franchise” system, mostly outside of China. They look for recently abandoned domain names that have good search results to increase traffic. It's a method that's “low-key” and “highly scalable,” bringing steady revenue through information theft. When search engines discover and wipe out a ring of stores, they'll simply copy and paste with a new set, rinse and repeat their technique to gather more data. .

Remember, in online shopping as in life: if something sounds too good, it is.