Security researchers have reported flagging 10 web addresses weeks before they were registered, then watching them go live as entry points to an AliExpress-themed phishing site.
EfficientIP Research Labs said it identified the potential .cyou domains on June 9 and added them to its DNS threat intelligence feed. They were subsequently registered and began resolving to IP addresses on July 2. Tracing their DNS and redirect activity led researchers to a fake AliExpress site.
Ten Disposable Entry Points
All 10 domains followed the same format of one digit and five lowercase letters, shared a registration date and resolved to three IP addresses in one subnet. EfficientIP called them DGA-style, but said the pattern alone does not prove a domain generation algorithm produced them.
None hosted the lure. Each sent visitors through a tracking layer carrying campaign, click or affiliate parameters, which EfficientIP said lets an operator replace exposed domains without rebuilding the campaign.
Because such domains have little history, EfficientIP said, reputation-based controls may not yet have classified them when the first visitors arrive.
The .cyou top-level domain adds context rather than proof. EfficientIP cited Cloudflare research which found that 62% of emails from .cyou in 2023 were malicious, while stressing that the ending alone does not make a site dangerous.
An Interisle Phishing Landscape 2025 study found 77% of phishing domains were maliciously registered and 37% were bought through bulk-registration services.
Read more on malicious domains: Hundreds of Malicious Domains Registered Ahead of Prime Day
A Lookalike Shopping Assistant
The chain ended at a site using a zero in place of the "o" in "shop," promoting a browser extension styled after Alitools, a legitimate shopping-assistant brand.
It claims more than 500,000 users and urges visitors to click "Add to Browser."
Several security services had flagged the site as malicious or unsafe, including ANY.RUN, whose sandbox tagged it as phishing on May 22. That predates the redirect domains by weeks, so the early warning applies to the entry points rather than the site itself.
EfficientIP said visitors risked credential and payment theft and exposure of browsing activity through the extension, while the tracking parameters could earn the operator affiliate revenue. It presented these as potential harms: the research reports no victims or losses, does not say how people were led to the domains and does not describe what the extension actually does.
EfficientIP advised blocking the domains and IP addresses and searching DNS and proxy logs for past connections. Where users engaged with the site, it recommended resetting credentials, contacting card issuers and removing the extension.
How the names were spotted before registration is not explained in the research. Infosecurity has reached out to EfficientIP for details on the matter.