Researchers Flagged AliExpress Phishing Domains Before Registration

EfficientIP Research Labs spotted 10 .cyou domains on June 9, weeks before they were registered on July 2. The domains redirected through tracking layers to a fake AliExpress site pushing a browser extension styled after Alitools.

• 10 .cyou domains registered July 2, flagged June 9
• Names follow one digit plus five lowercase letters, three IPs in one subnet
• Redirects led to fake AliExpress site with Alitools-style extension
• 62% of .cyou emails in 2023 were malicious, per Cloudflare