SECURITYWEEK reports that Sygnia has uncovered a live network of cloned, scam websites allegedly belonging to law firms, growing to more than 150 related domains. The investigation began after a single law firm flagged impersonating sites, and the network expanded from more than 60 websites to over 150 domains as the campaign persisted, according to Sygnia’s report.
The sites are registered across multiple registrars and IP ranges, each with a distinct SSL/TLS certificate, and many are deployed behind Cloudflare to obscure their relationships and hinder takedowns. The clones appear to target victims previously scammed, offering to recover money with payment only after funds are recovered, a tactic designed to add authenticity.
Amir Sadon, Sygnia’s director of IR research, notes that while there is an indicator of reused infrastructure such as phone numbers across campaigns, this should be treated as suggestive rather than definitive proof of a single actor, and the broader AI-powered scale and speed of the operation is likely to grow. According to Sygnia, the campaign demonstrates how AI tools enable the rapid creation of convincing sites at scale, potentially increasing online fraud as a whole.