Google Merchant Center Impersonation

Executive Summary

During infrastructure tracking, I identified 500+ domains and IP addresses impersonating Google Merchant Center and presenting visitors with a fake CAPTCHA verification workflow.

The infrastructure showed several recurring characteristics, including domain names associated with food, kitchen, and casino themes. A more useful pivot was identified inside the HTML source, where the same Gmail address was repeatedly present.

Searching for the email string within page bodies using internet-wide scanning infrastructure exposed a significantly larger cluster. At the time of analysis, FOFA returned approximately 555 related hosts.

Infrastructure Overview

The observed infrastructure is not limited to a single domain or hosting provider. Instead, multiple domains and IP addresses present highly similar page content and impersonate Google Merchant Center.

The repeated use of similar HTML structures, page content, and other artifacts provides useful clustering opportunities. Rather than investigating each domain individually, these recurring artifacts can be used as pivots to identify additional infrastructure.

Domain Naming Patterns

One of the first characteristics observed across the infrastructure was the naming pattern. A significant number of the domains contained themes related to food, kitchen, or casino.

Domain naming by itself is not sufficient to establish that infrastructure belongs to the same operator. However, when combined with identical page content and other technical artifacts, it becomes a useful clustering signal.

HTML Source Pivot

The strongest pivot identified during the investigation was a Gmail address embedded within the HTML source.

Instead of relying only on domain names or page titles, searching for the unique email string in the page body allowed the infrastructure to be correlated across multiple hosts.

Using this type of content-based pivot in FOFA produced approximately 555 related hosts at the time of analysis. This demonstrates how a small and seemingly insignificant artifact can become a powerful infrastructure-discovery pivot when reused across a large deployment.

The CAPTCHA Mistake

The fake CAPTCHA workflow contains another interesting operational mistake. The page presents a CAPTCHA-like verification step and instructs the visitor to copy the provided instructions and paste them into the Windows Run dialog.

This is not a conventional CAPTCHA verification mechanism. Instead, the CAPTCHA is being used as a social-engineering pretext to persuade the victim to perform an action outside the browser.

The implementation appears to have a copy/paste issue: when the visitor copies the displayed instructions, the clipboard content can include website HTML/source content rather than only the intended instruction.

For the operator, this is an unnecessary fingerprint. The same flawed implementation can expose reusable HTML artifacts across multiple deployments, making the infrastructure easier to correlate.

Google Search Visibility

Another notable observation is that some of the impersonating pages were also appearing in Google Search results. This increases the potential exposure of the phishing infrastructure beyond users who arrive through direct links, advertisements, or other distribution channels.

Search-engine visibility also provides another useful discovery path for researchers. Indexed pages can expose recurring titles, page content, domain patterns, and other artifacts that can subsequently be used to identify related infrastructure.

Key Findings

Finding	Observation
Impersonation	500+ domains/IPs impersonating Google Merchant Center
FOFA Infrastructure	Approximately 555 related hosts identified
HTML Pivot	Recurring Gmail address embedded in page source
Domain Themes	Food, kitchen, and casino-related naming patterns
Social Engineering	Fake CAPTCHA instructs users to perform a Windows Run copy/paste action
OPSEC Issue	Copy functionality can expose reusable HTML/source artifacts
Search Visibility	Some impersonating pages were observed in Google Search results

Conclusion

The most valuable pivot was the Gmail address embedded in the HTML source, which allowed the infrastructure to expand from an initial set of domains to approximately 555 hosts identified through FOFA.