Skimmers and Phishing

Labs Note

Recently, we shared a post about a network of domains used in a JavaScript credit card stealing malware campaign. These domains are all hosted on the same server with the IP

In addition to the domains used by the skimmers, the server also had two sites whose domains were clearly created for phishing two Canadian banks:

rbcroyalbank[.] – Real address of the Royal Bank of Canada is

www1-bmo[.] – Online banking for the Bank of Montreal is

Given that the goal of malware on e-commerce sites and bank phishing is to obtain payment details and steal money, it’s quite natural to see the same bad actors participating in both types of attacks.

Moreover, as Group IB wrote in April about the previous wave of these JS skimmers, this campaign is known for using fake Magento login pages on domains mimicking the domain names of the online stores they tried to compromise. So phishing and credit card skimmers complement each other very well.

Unlike other domains, where registrant details were hidden by privacy protection services, the rbcroyalbank[.] domain had public WHOIS information.

Creation Date: 2019-06-10
Registrant ID: 1319589-NIRA
Registrant Name: Julio Jaime
Registrant Organization: Media Lend, LLC
Registrant Email:

Most likely, this information is [mostly] fake—but it was enough to find another batch of phishing domains.

Fake Data:
While the data says the address is in Indiana, the zip code and city provided are in New Jersey.

The email “” suggests a connection to a Russian domain name registrar Most likely, it’s a dedicated email address used specifically for registering new domain names.

We used DomainBigData to search if anything else was associated with that medialand.regru account and found a whole bunch of other [mostly] phishing domains registered in 2019.
Here are just some of them:

facebook-bay[.]com  2019-03-29
facebook-s3[.]com   2019-04-04
facebook-s2[.]com   2019-04-04
facebook-s1[.]com   2019-04-04
facebook-listings[.]com 2019-03-30
facebook-listing[.]com  2019-03-30
facebook-itm[.]com  2019-03-30
facebook-state[.]com    2019-03-29
facebook-restore[.]com  2019-03-23
restore-facebook[.]com  2019-03-23
facebook-area[.]com     2019-03-17
facebook-ss[.]com   2019-03-29
recover-facebook[.]com  2019-03-23
facebook-st[.]com   2019-03-29
facebook-secure[.]com   2019-03-23
static-facebook[.]com   2019-03-23
facebook-us[.]com   2019-03-28
facebook-s6[.]com   2019-04-20
facebook-s5[.]com   2019-04-20
facebook-s4[.]com   2019-04-20

myetherevvalliet[.]com  2019-07-21
Bank phishing
carrefourbanque-compte[.]com    2019-06-18
www-1royalbank[.]com    2019-05-29
clickwebsite-rbc[.]com  2019-05-22
tangerine-en[.]com  2019-05-07
meine-db-account-i73983479[.]com    2019-04-08
acc7201-statement-online[.]com  2019-04-01
postecartaonline[.]com  2019-03-26
client-sofinco[.]net    2019-03-01
olb-secure[.]com    2019-02-20
mabanquepro-bnpparibas[.]com    2019-03-17
bmo-onlinebanking[.]com     2019-05-08
secure-banking-updt[.]com   2019-02-22
com-cgi-bin-3t5ufkygkl56-www-desjardins[.]com   2019-04-25

limited-services-paypal[.]com   2019-05-20
restricted-users-paypai[.]com   2019-06-28

Mobile carriers 
my3-bill[.]com  2019-04-18
three-mybilling[.]com   2019-03-28
threebilling[.]com  2019-03-08
myvodafone-billing[.]com    2019-03-12
account-billing[.]com   2019-03-15

apple-appield[.]com     2019-04-23
apple-restore[.]com     2019-03-28

You May Also Like