A guest diary by Joshua Nikolson on the SANS ISC platform describes using AI-assisted fraud campaigns and SEO poisoning to drive traffic to fake marketplaces that copy real product listings. The author notes that a VirusTotal page for the target URL showed no detections and green results at the time, but goes on to demonstrate how reverse image searches and product mirroring expose the scam, including a Texas Instruments TI-nSpire CAS calculator appearing on a promoted site.
One domain associated with the operation, desidrivingschool[.]com, was registered about 12 days before 3 April 2026, and the site’s sitemap[.]xml is used to flood search results with listings from compromised sites. The post outlines how checkout processes resemble Shopify, using Privacy[.]com to create temporary debit cards and showing that some payments are declined or accompanied by additional charges, with evidence of multiple tries on a single card.
Indicators of Compromise list several marketplace, redirector and payment page domains, and the author emphasises the attackers’ aim of stealing personal and payment information by selling items that are never shipped.