AliExpress Phishing Campaign Exposed with Early DNS Detection

• •Ten phishing domains linked to AliExpress were identified before registration.
• •The campaign used a convincing fake shopping site to steal user credentials.
• •DNS intelligence enabled early detection, allowing for proactive security measures.

EfficientIP Research Labs identified ten .cyou domains linked to an AliExpress phishing campaign before their registration on June 9, 2026. The domains became active on July 2, directing users to a fraudulent AliExpress-themed site that promoted a malicious browser extension. The campaign utilized a phishing redirect chain and familiar branding to deceive users, posing risks of credential theft and payment fraud. The domains followed a specific naming pattern and shared infrastructure, which allowed for early detection through DNS intelligence. This early identification provided security teams with a crucial opportunity to mitigate potential impacts before the domains were classified as malicious. The research highlights the importance of monitoring DNS activity for early threat detection.