A new malicious network (Ticket Heist) with more than 700 domain names is likely targeting Russian-speaking users who want to buy tickets for the Paris Olympics.
This scam network is offering fake tickets for the upcoming Olympic Games, as well as other major sporting and music events.
The researchers named the malicious campaign "Ticket Heist" and found that some of the domains had been created as early as 2022 and the attackers continued to register 20 new ones (on average) every month.
Fake Olympic tickets at high prices
In late 2023, QuoIntelligence noticed increased discussion about the Paris Olympics, a geopolitically significant event. At the same time, the International Olympic Committee’s decision to ban Russian and Belarusian athletes from competing under their country’s flag has drawn attention, and researchers are looking for suspicious activity online.
See also: Why is cybersecurity critical for the 2024 Paris Olympics?
QuoIntelligence was monitoring specific keywords (e.g. ticket, Paris, discount, offer) used in newly registered domains. While searching, it discovered the Ticket Heist malicious operation , which is based on 708 domains. These host websites claiming to sell valid tickets and offer accommodation options for the Paris Olympics, on July 26.
The first domains discovered were ticket-paris24[.]com and tickets-paris24[.]com.
Researchers noticed that all sites associated with the Ticket Heist operation have a similar UI with minor variations in content and language.
However, the most interesting thing about this campaign (besides the many convincing sites) is the price of the fake tickets. QuoIntelligence notes that the prices are significantly higher compared to legitimate tickets. In some cases, the prices can reach 1,000 euros.
QuoIntelligence researcher Andrei Moldovantold BleepingComputer that, while there is no confirmation, the higher prices could be a ploy to make victims believe they are getting "premium treatment" for the extra money, as the tickets are not available through official distribution channels.
Also, victims may believe they are buying at higher prices due to the lack of tickets.
The researchers attempted to purchase a ticket from one of the fraudulent websites to study the malicious activity. They found that all transactions are made through the Stripe and funds are only transferred when the card has sufficient funds. This means that the operator's goal is not to collect credit card information but to steal money from the victim.
See also: Olympics in France: Preparing for cyberattacks
Additionally, this test also revealed the company name VIP Events Team LLC, which was created on November 26, 2021 and is still active.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
“The domain was registered the same day the company was founded. However, there are no references to VIP Events Team LLC on Google, social media, TrustPilot, or other available OSINT sources” – QuoIntelligence
Additionally, while the company appears to be based in New York, the “contact us” section on ticket-paris24[.]com states that the company is located in Tbilisi, Georgia.
Researchers discovered that the fraudulent domains were hosted on the same IP address, 179[.]43[.]166[.]54, which belongs to a provider and is associated with malicious activities.
Currently, 98% of domains associated with Ticket Heist are considered pure malware, which supports the theory that the goal is to directly steal money from victims, via a legitimate payment.
The Paris Olympics are a very important event, which is why cybercriminals are exploiting it to scam unsuspecting victims.
QuoIntelligence says that Operation Ticket Heist is underway, showing that many scammers are trying to take advantage of the Olympics this year.
See also: Ticketmaster: Hackers leaked print-at-home tickets for 154 events
The company provides a set of indicators of compromise (IoC) for the Ticket Heist feature, which can be used by the cybersecurity community to protect customers.
How can users identify fake websites?
Before purchasing tickets for the Olympics, users should be careful and check the pages by carefully examining the URL. Fake websites often use addresses that look similar to the real ones, but contain small differences, such as additional letters or numbers.
Another way for users to identify fake websites is to check the website's security. Authentic websites use SSL certificates, which appear as 'https://' in the URL and are accompanied by a lock icon.
Also, special attention should be paid to websites that request personal information or payment details without providing sufficient information on data security and protection.
The quality of the content can also be indicative of fraud. Fake websites often contain grammatical errors, poor syntax, and generally poor text quality, as well as low-resolution images.
In general, users should visit the official website of an event to be sure they will find legitimate tickets (e.g. for the Olympic Games).
Source: www.bleepingcomputer.com
