Authorities shut down Russian spoofing websites alleging to be Amazon, Netflix, banks

The US Attorney for the Western District of Pennsylvania announced the seizure of four website domains from a Russian internet infrastructure company on Thursday.

The domains were seized, alleging they were used as a spoofing service. The authorities claim the domains were used for its services to create and manage spoofed websites designed to look like the legitimate websites of businesses such as Amazon, Netflix, Wells Fargo, Bank of America, and Chase Bank. 

Warrants for the seizure were issued in the Western District of Pennsylvania court. They were executed in coordination with the arrest of dozens of administrators and customers of the illicit service by foreign law enforcement agencies.

According to court records, the US obtained authorization to seize the domains as part of an investigation of the spoofing service operated through a Lab-host.ru domain (LabHost), which resolves to a Russian internet infrastructure company.

According to the authorities, LabHost customers used the spoofed websites to lure unwitting victims into disclosing their personally identifiable information such as date of birth, email address, password, address, and credit card information—on the spoofed websites the victims believed were legitimate.

According to court documents, LabHost was used to create more than 40,000 spoofed websites, and its infrastructure stored over one million user credentials and nearly 500,000 compromised credit cards.

The four LabHost API domains were registered to NameSilo, LLC, a third-party web hosting service based in the United States. According to court records, the seized domains represented property used to commit violations of federal criminal law, including access device fraud, computer fraud, wire fraud, identity theft, and money laundering.

“Together with our international partners, the Justice Department has disrupted another cybercrime scheme originating from Russia that enabled criminals to steal from over a million victims in the United States and around the world,” said Attorney General Merrick B. Garland. “I am grateful to the U.S. Attorney’s Office for the Western District of Pennsylvania, the FBI, and our partners at the Secret Service for their work on this case, and to our foreign law enforcement partners whose efforts have led to the arrests of dozens of LabHost administrators and users.”

The domain seizures in the United States occurred in conjunction with the international arrests of dozens of LabHost administrators and customers facing criminal charges in more than a dozen foreign countries. Law enforcement authorities from the following countries participated in the investigation: Australia, Austria, Belgium, Canada, Czechia, Estonia, Finland, Ireland, Malta, the Netherlands, New Zealand, Poland, Portugal, Romania, Spain, Sweden, and the United Kingdom.