Retail and E-commerce
Retail Fraud Uses Your Brand as Bait.
Retailers and marketplaces are imitated wherever customers shop: lookalike storefronts, fake order-tracking and refund pages, promotions that exist only to collect card numbers.
The Deepinfo Platform finds the domains built on your name, your customers’ credentials and cards in leaked data, and the exposures on your storefront and the vendors behind it.
- Asset discovery: in the yard, a shuttered pop-up that was the staging store, nobody listed: staging.shop.example, not in inventory.
- Continuous scanning: in the store’s window, the poster of a campaign: campaign.shop.example, 8443/tcp newly open, high, caught between two scans.
- Risk detection: the storefront, under the store’s sign: www.shop.example, PHP 7.4 end of life, high.
- Risk scoring: in the warehouse office, the server behind the order API: api.shop.example runs Apache httpd 2.4.49: CVE-2021-41773, CVSS 9.8, listed in CISA KEV, critical.
- Cyber Threat Intelligence: in a customer’s home down the street, an infected laptop: shop.example login, in an infostealer log.
- Brand Risk Protection: next door, a copy of the store that is not yours: sh0p.example, lookalike · fuzzy.
- Third-Party Risk Management: at the checkout and at the dock, the payment vendor’s terminal and the fulfillment vendor’s van, drawn dashed because they are not yours: payment-vendor.example, graded C; logistics-co.example, graded B, each linked to shop.example.
Your Brand, and What Could Be Registered.
Brand Risk Protection matches newly seen domains against your brand and product names, from exact matches to lookalikes written in other alphabets. Each suspicious domain stays under watch across DNS, mail, certificate and HTTP, with a risk score and its timeline.
-
shop.example
-
shop.test
-
shop-login.example
-
sh0p.example, digit zero for o
-
shpo-verify.example, swapped “op”
-
ѕhop.example, U+0455 CYRILLIC SMALL LETTER DZE
resolves as xn--hop-ehd.example
-
ѕhop-login.example, U+0455 CYRILLIC SMALL LETTER DZE
resolves as xn--hop-login-k9h.example
-
sһpo.example, swapped “op” · U+04BB CYRILLIC SMALL LETTER SHHA
resolves as xn--spo-2sd.example
-
secure-sһpo.example, swapped “op” · U+04BB CYRILLIC SMALL LETTER SHHA
resolves as xn--secure-spo-vzj.example
Fraud That Starts Outside Your Store.
Impersonation
Lookalike Storefronts
Copies of your store on a name one character away, taking orders and card numbers for goods that never ship.
Accounts
Account Takeover
Customer logins saved in infected browsers or reused from other breaches. A takeover spends stored balances, loyalty points and saved cards.
Cards
Card-Not-Present Fraud
Leaked cards, some with the CVV attached, are tested and spent at online checkouts, yours included. Chargebacks follow.
Vendors
Checkout Supply Chain
Payment, analytics, marketing and fulfillment vendors run code or hold data at the most sensitive point of the purchase.
What Each Leaked Record Carries.
Cyber Threat Intelligence finds your customers’ logins and payment cards in infostealer logs, breach data and card listings. Each record moves through tracked states until your team closes it.
Compromised Client Credential Monitoring
A customer login to your store, found in an infostealer log and tied to the URL it opens. Force a reset, revoke sessions and add friction to risky orders.
Compromised Payment Credential Monitoring
Card number with BIN, issuer, brand, expiry and CVV presence, where it was listed and how often it was seen. Work batches by leak and source, and pass the evidence to your acquirer or the issuers.
Employee Email Breach Monitoring
Staff addresses in known breaches, with the data types each breach exposed. Reset credentials and brief the people behind them.
Dark Web Mentions Monitoring
Your brands and domains named on forums, markets and leak sites. Triage the mentions that point to a leak or a campaign.
j.masked · shop.example
Login record
Leaked login:
-
URLhttps://shop.example
The URL it opens:
-
Username · typej.masked · email
-
Target serviceshop.example · your store
-
Sourceinfostealer log
Where it was foundsaved in an infected browser:
Force a reset, revoke sessions and add friction to risky orders.
Newly detectednewly_detected
Scan Your Checkout and Everyone in It.
External Attack Surface Management scans your storefronts, campaign sites and API hosts across every layer, from DNS to web data. Web data shows the technologies on each page, so an end-of-life platform version or a forgotten staging store is visible.
Third-Party Risk Management applies those scans to payment, fulfillment and marketing vendors and scores them on your scale. Findings on both sides are classified against PCI DSS 4.0 and 3.2 as they are raised.
- Your side
- Storefronts, campaign sites, API hosts
- Vendor side
- Payment, fulfillment, marketing, analytics
- Scoring
- One scale for both
- Mapped
- PCI DSS 4.0 (
pci_) and 3.2 (4_ 0 pci_)3_ 2
Use Cases for Retail Fraud Teams.
Each one opens the full workflow. The tag names the modules it runs on.
The Data Is Yours to Use Too
The index under the platform is also sold as data. Teams that build their own tooling query it through the API or take it as bulk feeds, and Internet Insights shows what it sees each day.
Questions About Deepinfo in Retail and E-Commerce
Can Deepinfo get a fake store taken offline?
Confirmed lookalike domains go to Managed Takedown. Deepinfo’s team files the removal request with the registrar or hosting provider, attaches the evidence and follows it up. The registrar or host makes the decision, and monitoring shows whether the domain still answers.
Can we be alerted when a lookalike store appears?
Yes, once it is confirmed. A new fraudulent domain, approved by your team or by a rule set to auto-approve, is a notification event, sent to the team members a rule names, instantly or in an hourly, daily, weekly or monthly digest.
Can rules catch storefronts registered before we started?
Yes. With include_ on, a new rule also runs against domains registered before it existed.
Do we have to review every candidate by hand?
No. Candidates can be approved or ignored in bulk by filter, and a rule your team trusts can approve its own matches.
How do merchants use leaked card data?
Card records carry BIN, issuer, brand, expiry, CVV presence, where each card was listed and how often it was seen. Merchants filter by leak name and source to see batches as they appear, and pass the evidence to their acquirer or the issuers concerned.
Do you monitor app stores and social platforms too?
Brand Risk Protection lists app store, social platform and search engine monitoring alongside domains. Coverage for those channels is agreed for your brand before monitoring starts. See app store monitoring for how it works.
See Who’s Selling Under Your Name.
Book a demo scoped to your brands and login domains.